Answer by Wayne Werner for Why is it wrong to *implement* myself a known,...
Another reason that goes hand in hand with many of the other answers, from the fact that doing encryption well is hard: Getting encryption right is expensive. Getting encryption wrong is expensive....
View ArticleAnswer by DrM for Why is it wrong to *implement* myself a known, published,...
Very simply, older more widely used encryption software, has been subjected to more testing (friendly and unfriendly) and more analysis. Moreover, the history of encryption is littered with broken...
View ArticleAnswer by jl6 for Why is it wrong to *implement* myself a known, published,...
I’d like to offer a slightly different perspective... It’s not that nobody should ever implement cryptography. After all, somebody has to do it. It’s just an extremely daunting task and you should ask...
View ArticleAnswer by drjpizzle for Why is it wrong to *implement* myself a known,...
Well this escalated quickly. I realise this will not be popular but, if you think you know what you are doing and you have a good understanding of the language your using and the way in which its being...
View ArticleAnswer by Jennifer for Why is it wrong to *implement* myself a known,...
The problem with using well-known professionally implemented algorithms is that all you have to protect the message is the key. If Evelyn can find out (or guess) the key, then the message can be...
View ArticleAnswer by mckenzm for Why is it wrong to *implement* myself a known,...
It's not, and this appears to be directed at the layperson as warning to leave it to their betters. If the implementation does not exist for your language, someone is going to need to do it. It is not...
View ArticleAnswer by AJ Henderson for Why is it wrong to *implement* myself a known,...
It's extremely easy to get cryptography wrong if you implement it yourself and don't have an extremely solid understanding of it. Of the home grown implementations I've seen in my career, I can't think...
View ArticleAnswer by Mark for Why is it wrong to *implement* myself a known, published,...
Even in situations where side-channel attacks are not possible, cryptographic algorithms often have implementation details that are security-critical but not obvious. Two examples: The ECDSA signature...
View ArticleAnswer by Emilio M Bumachar for Why is it wrong to *implement* myself a...
The case against rolling your own crypto is that bugs can hide in crypto software without symptoms, even in the face of extensive tests. Everything will seem to function perfectly. For example, in a...
View ArticleAnswer by Cort Ammon for Why is it wrong to *implement* myself a known,...
The side channel attacks mentioned are a big thing. I would generalize it a bit more. Your crypto library is very high risk/high difficulty code. This is often the library that is trusted to protect...
View ArticleClik here to view.
Answer by MechMK1 for Why is it wrong to *implement* myself a known,...
The reason why you want to avoid implementing cryptographic algorithms yourself is because of side-channel attacks. What is a side-channel? When you communicate with a server, the content of the...
View ArticleAnswer by Augusto for Why is it wrong to *implement* myself a known,...
I think the small print says: It's OK to implement a cryptographic algorithm as long as your code is bug free and avoids every pitfall on every platform (OS and architecture) where the code will run....
View ArticleWhy is it wrong to *implement* myself a known, published, widely believed to...
I know the general advice that we should never design¹ a cryptographic algorithm. It has been talked about very extensively on this site and on the websites of professionals of such caliber as Bruce...
View Article
