20 ms·
Code complexity != insecurity. Case in point, many cryptographic algorithms are complex (by non-cryptographic standards) but essential. That doesn't make them
by iuguy 17y ago
Code complexity != insecurity.
Case in point, many cryptographic algorithms are complex (by non-cryptographic standards) but essential. That doesn't make them insecure, just less inscrutable.
It is when 'things are missed' in information security that insecurities occur (e.g. developer is not aware of strcpy limitations so uses it regardless) - writing a simpler malloc will not save you from a stack-based overflow.
- cperciva 17y agomany cryptographic algorithms are complex I'd dispute that. Aside from multiprecision arithmetic for asymmetric cryptography, which I'll admit uses a fair number of lines of code, most cryptographic algorithms are quite small (SHA256 and AES are both well under 200 LoC); and all well-written cryptographic code should be "straight-line" code, i.e., with a cyclomatic complexity of 1. e.g. developer is not aware of strcpy limitations so uses it regardless Nothing will save you from developers who blindly use functions without knowing what they do. I was writing for the benefit of those people who already meet a certain minimum level of competence.
- dasil003 17y agoAlgorithmic complexity is dwarfed by real world software complexity the vast majority of the time. However, even for pure math I think the thesis still stands just fine: more complex mathematical proofs are more likely to contain flaws than simple ones. Things "can be missed" at any level, in real code or theoretical, which is why you want to minimize any opportunities for things to be missed.