Hacker News Reader

Comment by zgs | Hacker News Reader

Do *not* implement your own cryptography. There are a lot of nuances.

This is a very dangerous article. The basic RSA algorithm is quite simple to implement, although the most difficult part isn't done in this article -- multi-precision multiplication is the difficult part in my experience.

However, using this implementation cryptographically is very bad. A cryptographically good implementation needs to consider a lot more than just the basic algorithm. Is the implementation constant time? Does it including blinding? How is it padded? These are just the basics, they are plenty more subtleties. Then people want it fast.

RSA should not be used to encrypt plaintext. Simplistically: symmetric cryptographic algorithms are first used and then RSA is used to encrypt the key.

View on HN

Implement your own cryptography library, just be careful about using it. Why are we telling people to not learn by doing? You can even get some constructive criticism if you post it here. :)

Because similar to deep learning now, we like the cloak and dagger approach to cryptography. Keeps the salaries high.

You are right.

What is a good idea however, is to implement a TLSv1.3 library in Visual Basic 6[1], that doesn't have any external dependencies, by embedding machine code for AES encryption generated with MSVC in the source code, that you patch into memory at runtime, by using all sorts of tricks to do things in VB6 that you aren't supposed to do in VB6. Yes, that VB6, that was released in 1998, superseded by VB.NET in 2002. Because Microsoft has just announced it's supported on Windows 11.[2] So when developing new software, why not use something future-proof? ;)

[1] https://github.com/wqweto/VbAsyncSocket

[2] https://docs.microsoft.com/en-us/previous-versions/visualstu...

The amount of corporate cognitive dissonance required to refuse to acknowledge that dropping VB was a huge mistake and yet continue to support it - because it’s still widely used because it’s so effective - over 25 years must be staggering.

Implementing it yourself is a good way to understand how it works and is often part of required CS courses.

I don't think the article said anything about using it in production.

We did exactly this in a Cybersecurity program at Georgia Tech.

Those who want to weaken cryptography now or in the future smile every time the advice to not implement your own cryptography is given. (Which is not to say everyone giving the advice wants to weaken cryptography, and yes, there are real reason to be extra careful.)

Reply on news.ycombinator.com