3 ms·
What I've been doing is just reading the code of already audited inplementations of cryptography to understand it better. For example Skein/Threefish. As a test
by dobbsbob 13y ago
What I've been doing is just reading the code of already audited inplementations of cryptography to understand it better. For example Skein/Threefish. As a test to see what kind of speed SHA-3 would have on a mobile device I implemented my own Threefish SHA3 on Android for full disc encryption. First I looked at Pyskein, Java skein and all the other implementations released by pros. Then I looked at everything the authors who submitted other NIST3 finalists wrote, blogged and argued about on mailing lists. Then I read about the android SHA-1 design decisions. Then I watched lectures on crypto software engineering. Then I looked up everything about accelerometer side channels, PRNGs problems and gotchas, Moxies blog posts, and his yaffs source he used for whispercore, and went through tons of Dos and Dont comments both here and on Schneier's blogs about writing secure software. Then I watched BSDcon coding the openbsd secure way, and talked with maintainers who implement crypto on the openbsd mailing list.
Result is SHA3 full disk for Android. Its certainly not foolproof or nor do I claim its secure but a lot of people are digging through the source and forensics hackers are interested in seeing what they can do with it. I realize I broke cardinal rule of using something that hasn't been proven for decades first (like AES 256) but its been a good learning experience thats for sure.
- tptacek 13y agoI think it's hard to know what you don't know.