1

We know we shouldn't roll our own crypto, apparently that includes writing our own implementations of the language included cryptography extensions. So that begs the question, how do we find a suitable security provider or API should we use and why?

In the case of Java 8, I've come across Apache Commons, OWASP ESAPI (Which the very author of seems to recommend against using) and Bouncy Castle. While I don't want to limit the scope of the question to these three providers, I believe these could be useful examples to compare what to look for in a security API/provider since they seem to be somewhat popular.

What aspects should one focus on when searching for a suitable implementation of a crypto API? Where can one find more information on the subject? And how can one avoid bad or malfunctioning crypto APIs?

Improve this question
5
  • Sadly this question would also eventually end up being dated (like the other questions that you found) so I would recommend closing this question. I have heard that bouncy castle is good but I haven't done a lot of research so I can't say whether it is production grade or not.
    – Limit
    Commented Jun 12, 2017 at 18:25
  • @Limit, While I do agree, I haven't been able to find a decent answer anywhere. It might just be a band-aid, since there is a lack of a decent resource around the topic, but it's better than nothing IMHO.
    – Daniel V
    Commented Jun 12, 2017 at 19:08
  • 2
    We close recommendation questions because they just end up terribly out of date (which with security products is particularly problematic). If you can reformulate your question to instead be along the lines of "How do I evaluate different options?" then that will be on-topic.
    – Xiong Chiamiov
    Commented Jun 12, 2017 at 19:28
  • @XiongChiamiov rephrased the question, thanks for the recommendation. I included the three providers I mentioned before, is that OK or should I remove them entirely?
    – Daniel V
    Commented Jun 12, 2017 at 19:52
  • I think it's good, but others might weigh in.
    – Xiong Chiamiov
    Commented Jun 13, 2017 at 18:53

1 Answer 1

Reset to default
1

Getting Started

First, before you dive into the world of Crypto-Libraries, you need to understand the abilities of your development team. Do you have developers or do you have power-users with sudo development knowledge?

This is important because it likely determines the ability for a person understand an API's purpose, vs implementing it and crossing your fingers.

Crypto-Modules

If you want the Shortest Answer, find one that is FIPS PUB 140-2 compliant. If you not familiar, its basically the government standard for Crypto-modules. I'd minimally suggest looking at the Wiki and get a general understanding of the standard.

Most Crypto Libraries worth there implementation are at least Level 1 Certificated. A list of them can be found here.

High Level vs Low Level Interfaces

When people say don't role your own Cryptography, they tend to mean, don't reinvent the proverbial wheel. I.E Don't build your own libraries based on what you think the algorithms should be. (Stick with FIPS)Since we established that your not going to do this (right?) than the question is how do you best use these tools.

Some Libraries give you an interface for the low level functions, like Java's Cryptography Extensions (JCE). These libraries have all the algorithms and and Object needed for Cryptography, but will probably require a developer to abstract away those function in most cases.

Some libraries offer a high level interface, such as OpenSSL, which abstracts away a lot of low level work and you just make the calls. Many may argue that you should uses this, however, as many developers experienced by using OpenSSL libraries willy-nilly, if you don't know what your using at the Highest level, you can end up digging to find out if your vulnerable.

There is also Cryptography As A Service. Personally, I don't have much knowledge on them. They usually offer an API (such as REST) for you to send your Cryptographic needs too.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .