Don't Roll Your Own Crypto
Comments repeatedly emphasize the advice against implementing custom cryptography, highlighting risks, pitfalls, and the need for established, audited libraries by experts. Discussions include nuances like learning exceptions, production use warnings, and distinctions between algorithms and implementations.
Activity Over Time
Top Contributors
Keywords
Sample Comments
Sorry, but this is not good advice. Widely-used crypto implementations have had the benefit of years of analysis by dozens of high-expertise stakeholders who have a lot to lose should the crypto fail. Even that isn't always enough to catch all weaknesses and vulnerabilities.This cowboy-programming attitude being extended to security is no small part of why we are so vulnerable as a society to attacks on our computer systems that can compromise our core infrastructure[1], our secrets[2],
Indeed. If you're not a cryptographer then you shouldn't be rolling your own crypto. That includes selecting low level libraries, etc. You want a whole crypto system that's made by experts. Preferably one that's open to auditing.
Unless you're a cryptographer, don't even think about rolling your own crypto (I'm not one, I did, and I'm ashamed of myself).
"But crypto is hard! Don't roll your own", say everyone, ever.
I think there's a more fundamental cryptographic principle. Don't implement cryptography, unless you are an absolute top expert. Even then, think twice, and get another absolute top cryptography expert to check your working. Use a pre-existing cryptography package that has been written properly instead.
Don't roll your own crypto. If that was much better encryption, everyone would be using it.
Do not roll your own crypto is meant for software engineers, not a team of professional cryptologists.
Isn't this the point of the usual advice, "don't write your own crypto"? There are a million gotchas, and most of these you've just gotta know.
Isn't this the point of the usual advice, "don't write your own crypto"? There are a million gotchas, and most of these you've just gotta know.
You're right! That's perfectly normal and extremely common.People are skittish about this in the realm of cryptography because the costs of getting it wrong can be very high. Further, programmers have a culture where experimenting by writing something yourself is perfectly reasonable and extremely common.When these two meet in the context of crypto, I know just enough to get worried that someone's going to get overconfident from a primer and do something they believe to be v