Tptacek vs. Filosottile on rolling own crypto

All generalizations will be overly broad, but for the most part most people should not be rolling their own. Some will be fine, but they usually know they know enough to ignore the “rule”.

Rolling your own and having others depend on it is taking on a bit of liability. I am not sure I could defend that action if I was brought into court due to a weakness in a library I wrote or had some developers write. Phrases like "industry best practice", "fiduciary responsibility" and "standard practice" would be used and I doubt I could counter that, especially if the data was for financial transactions. Has anyone tried this and been legally challenged?

Where I've disagreed with Tptacek in the past is on cipher fixation. Making everything in the world use AES and having all hardware offloading only accelerate AES is something I would expect from the military or lazy hardware developers. Rijndael (AES) was not even supposed to win the competition, but NIST made it win. The article on the competition has had some revisions. Either way, I do not like being limited to one or two ciphers. There should be many and we should rank them in strength. There should be annual competitions to break each of them. When one is "broken", it should be deprecated via a scoring system, but not made obsolete, because broken usually has varying degrees of real world feasibility. Each industry should then decide which ciphers are appropriate for their own risk tolerance.

When it's only me talking to me, I "roll my own" and layer it on top of standard encryption libraries. Nobody can complain about that unless their goal was to decrypt my communications to me. It's not really "rolling my own" so to speak, I just make subtle math changes to the standard libraries. This goes back to a lesson I learned some time ago when messing up a friends Rubix Cube. The more subtle changes I made, the longer it took him to solve it. That is just my personal preference for my own things and only affects me.

The problem with rolling your own is you don't know you've messed up until the damage is done, even then you may not know.

Hehe, I’d watch that stream for sure.