Why exactly would you do any of this instead of
a) just having a field of 32 bytes in the wire protocol (if binary)
b) just turning it into a hex string (if text is needed) or base64/85 if you don't want hex for some reason
a) just having a field of 32 bytes in the wire protocol (if binary)
b) just turning it into a hex string (if text is needed) or base64/85 if you don't want hex for some reason
Because it's your first adventure in the land of crypto and you have no idea how to do things, which parts you need to learn about and which are not required. It seems trivial for me now, but there was a time I would end up on a similar journey.
I don't know of a source which would do a quick walk through all of these levels. And if there is one, I don't know how you'd find it without knowing the right keywords.
(Now I'm tempted to write up some "crypto and certificates and public keys and other things explained quickly and without depth so you can ask better questions next" post)
> Because it's your first adventure in the land of crypto and you have no idea how to do things
is rather presumptuous. I do actually know how to do crypto things (I review and test such things for a living) and after reading their comment and skimming the post I'm left wondering the exact same thing.
What I'm puzzled by is, why did you feel the need to suggest that the comment in question can be considered an attack on someone, when it is clear (to the both of us, as you point out), that it isn't so?
Edit: I say this because I always think about this guideline before I comment:
> Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith.
Opinions are my own :)
sigh
Of course it all depends on your domain. Maybe you build an app that won't be used any more in 3 years. But if you feel like your protocol will be implemented by many vendors and you might want to allow vendors to use multiple algorithms so that support for alternatives is already present if a vulnerability is found in algorithm, it's better to have self describing key data instead.