0

Its usually recommended that 'don't use your own system of Crypto' rather use standard SSL/TLS! I understand that SSL/TLS is a complete protocol suite that addresses all three elements of CIA triad. What if I need to use a subset of CIA, say I just need Authentication and Data Integrity. In such a cases isn't using full SSL/TLS is an overkill?

what's the issue / risk, if I make and use a customized crypto suite which addresses my specific requirements like in this case for if I just need Authentication and Integrity, I use only digital signing of data with a digital certificate; and skip the encryption part of data (confidentiality is not a concern).

  • 1
    If confidentiality is not a concern, then having confidentiality is not a downside, even if not required. – MechMK1 Jun 23 at 13:19
  • "is it ok to roll my own crypto if existing crypto does more than what I need it to?" -- no. That's not a good reason to expose yourself to the inevitable poor crypto that you will end up with. You don't state why your approach to your own crypto addresses the reasons why "don't roll your own" is the advice in the first place... – schroeder Jun 23 at 13:49
  • @schroeder I mean what is risk if I use strong crypto only but not the full suite! say instead of full suite TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, I just use a tailored down suite like RSA_WITH_SHA384! – Akhilesh Gupta Jun 23 at 14:15
  • 1
    @AkhileshGupta You still have not explained what the problem with using a well-tested TLS suite is. It's like saying "I want to buy a new car, but this car I want to buy has a heated back window, and I don't need a heated back window. What should I do?" – MechMK1 Jun 23 at 14:39
  • @MechMK1 well, like I stated in my question - for scenarios where I don't need all elements of CIA in a communication, why a full TLS suite should be used! like in a scenario where a point to point wired ethernet connection is there; and confidentiality is not a concern. so sending data in encrypted form is not a requirement.. is it a good idea to use full TLS suite in such scenarios as well? In other words do I need to use full TLS suite in all communication scenarios as a defacto standard! Thanks – Akhilesh Gupta Jun 24 at 4:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.