4 ms·
There is infinitely more to writing secure software than correctly using secure cryptographic constructs.
by pharrington 12y ago
There is infinitely more to writing secure software than correctly using secure cryptographic constructs.
- Nursie 12y agoThis is what I should have said a few messages up the chain! Writing secure software is hard and covers a lot more than your choice of ciphers, protocols etc. It's possible to make all the right choices and still make insecure software for so many reasons. OpenSSL was referenced up-thread - simple buffer overruns/lack of bounds checking is one way in which that failed (heartbleed). In order to write secure software one needs first to define what we're aiming at, what does secure mean in the domain in which we operate? And that's non-trivial in itself. But by choosing well-known constructions and (hopefully) well tested implementations we can minimise some classes of potential problems.