3 ms·
> is that you get very little feedback on this. Are there any easy-to-implement tests for this sort of thing? For example * For mathematical functions, I can
by majelix 13y ago
> is that you get very little feedback on this.
Are there any easy-to-implement tests for this sort of thing? For example
* For mathematical functions, I can trivially test for an expected value, a too low value, a too high value, and not a number input.
* For input/output sensitization, I can pump crazy unicode characters or system code.
* For encryption, I can ... open up tcpdump and see that it's ostensibly garbage-looking?
- sdevlin 13y agoUnfortunately, I don't think so. It's pretty easy to eyeball your ciphertext and think it's sufficiently garbage-looking, but it's difficult to predict what an attacker can do with access to your running system. Seemingly innocuous flaws can lead to complete plaintext recovery or the ability to forge arbitrary ciphertext. (Here's a fun way to get a taste: http://www.matasano.com/articles/crypto-challenges/ http://www.matasano.com/articles/crypto-challenges/) @cperciva is right that cryptographic security is something that needs to be proven. Since I'm not smart enough to do that, I avoid designing my own crypto systems, and I recommend clients do the same. Lots of risk, little or no reward.