4 ms·
Well, I'd rather see a really well written crypto lib in C, than a half finished one in Haskell, but yes I see your point. My main thing is that "genius has its
by IgorPartola 12y ago
Well, I'd rather see a really well written crypto lib in C, than a half finished one in Haskell, but yes I see your point. My main thing is that "genius has its limits" and all that: you can make mistakes in any language and it's not your choice of language that automatically determines if you are going to write crappy code.
If you can't write a piece of code in Python that won't kill a person, I don't really trust you to write it in Rust either.
- the_why_of_y 12y agoActually I wouldn't want to see a crypto library in Haskell - crypto is quite special in that there is a requirement of deterministic timing, to prevent leaking secrets via timing attacks, which is rather impossible to guarantee in a high-level language, especially with a "smart" compiler like GHC that may optimize in non-obvious ways. Hence it could actually be most secure to implement cryptographic primitives in assembler, however counter-intuitive that may sound. (Also, how do you erase or overwrite secrets from memory after use in a purely functional language?)
- tome 12y ago> (Also, how do you erase or overwrite secrets from memory after use in a purely functional language?) Your other concern is valid, but this is easy: Haskell has mutable arrays.
- the_why_of_y 12y agoMutable arrays are not sufficient as they may still be moved to a different location at any time by the garbage collector. Guess the StorableArray is the one that should work here.
- tome 12y agoI don't know the specifics but there are some details here about how to allocate such pinned arrays: http://en.wikibooks.org/wiki/Haskell/Libraries/Arrays#Welcome_to_the_machine http://en.wikibooks.org/wiki/Haskell/Libraries/Arrays#Welcom...
- codygman 12y agohttps://github.com/vincenthz/hs-tls https://github.com/vincenthz/hs-tls You should be able to exploit this quite easily if what you said is true, right?