35

This is just an academic question, I do not intend to write my own crypto software.

Every time someone asks the question “How do I write my own Crypto?” the answer is don't.

I'm currently studying computer science, and there is no course offered by the university which seems to be helpful. There are some courses offered by the Math department that could lead to a research career in crypto algorithms, but nothing about implementing the algorithms and avoiding side channel attacks. But obviously there are some people out there writing good crypto.

Is it just reading about vulnerabilities and remembering not to do the same thing? Or where does the needed knowledge come from?

closed as primarily opinion-based by Eric G, Xander, schroeder, D.W., Scott Pack Jul 16 '15 at 2:02

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Implementation of cryptographic algorithms seems to normally be a team effort. Presumably with a lot of code reviewing. – S.L. Barth Jul 15 '15 at 11:50
  • 3
    Funny story: I took a crypto class in college. We had to pick a crypto-related final project, so I decided to implement DES. True to character, I procrastinated until the last day. When it was due, I suddenly realized I didn't know how to use bitshift operators in JAVA. Rather than just looking it up (that would take TIME!), I implemented DES using the String class and actual strings of "1" and "0" characters. I parsed the incoming file into bytes, converting them to 8-character strings. When I presented my code to the class nobody called me out. Got an A, which helped cope with the shame. – loneboat Jul 15 '15 at 22:22
  • Needed knowledge for what? You appear to have answered your own question: crypto classes are in the math department, not computer science. People writing good crypto libraries have a strong math background. – schroeder Jul 15 '15 at 22:50
  • "My university offers no courses" - There are no textbooks or publications you can read? – Superbest Jul 16 '15 at 1:00
29

Mostly, yes, this is about writing code and remembering not to do anything bad. At its core, the crypto-code writing process really is a combination of understanding and updated knowledge.

To write crypto code, you have to fully know how the code you write gets translated into assembly, then machine code, then electric signals; it can help to have some notions on how a transistor works. You do not have to develop in assembly, but you must be able to think about what your code becomes. Observing the assembly output from the compiler (assuming you work in C or something similar) is very instructive.

The point of this knowledge is that most fashionable attacks nowadays are about side channels, that feed on subtle differences in execution time or memory access pattern or power consumption of code. Programming languages are meant to provide an abstract view that hides all these details; the successful crypto coder is one which can undo that abstraction in his head as he writes the code. A crypto coder must master his programming language to the point that he could write the compiler itself (not that he will do that, be he must be able to).

Then you have to maintain yourself up-to-date with all known attack vectors, which means keeping track of all discoveries on that subject. Experimentally, I find that this very site (security.SE) and the endless ramblings of the chatroom users is a good method to pick up some information -- however, once you know that a potential attack exist, you have to dig up a bit, including reading the academic papers and abstracts, which requires, of course, skills at reading academic papers (the kind of skills that you acquire when you do a PhD).

A crypto implementation can be considered as good only insofar as it can be reviewed, so, regardless of how well you write it, you still need to document it heavily. Security cannot be tested, so some code can be considered as secure only if it can be fully understood. The "burden of proof" lies on the developer's shoulders: it is not sufficient that nobody found a way to break through the code (yet); the developer himself must explicitly demonstrate why his code is fine.


All of this is about implementation of an existing, standardized algorithm. For instance, you are writing an RSA code. The standard is very specific about where each bit should go, so your job is "only" to make a robust implementation that does not leak information about the key or the encrypted data (which basically means using random blinding, or constant-time code with a fixed memory access pattern). When considering embedded devices with an external, attacker-controlled power supply (e.g. smart cards), the problem becomes a lot more complex and can be defined only as "high-level research" (and smart card vendors employ high-level researchers exactly for that reason). For more mundane software platforms, this is doable by a lone programmer, provided that he masters his tools and knows how to use academic research.

Designing your own algorithms, or your own protocols (a protocol can be defined as an assembly of algorithms), is another can of worms. A big one.


I am not sure whether it is possible to sum up all the required knowledge for good crypto coding as a teachable set of rules. However, some people are trying. That Web site might not be the ultimate answer, but at least it contains lots of good advice and pointers, and can at least serve as a list of things to watch for. Don't try to write production-level crypto code until you can read the coding rules and at least understand what each listed problem is, where it comes from, how it could be exploited, and why you should mind it (or not) in your specific context.

Ultimately, skills at good crypto coding are built on experience so the best you can do in that respect is to begin by writing some implementations yourself, then compare them with other implementations and see in what aspects they differ and why. Hash functions like the SHA family are a good starting point.

  • 4
    +1 that coding rules page is a gold mine. I have seen many of the rules else where but having all in one place with code samples is invaluable. – Anthony Jul 15 '15 at 14:07
3

not exactly answer to your question but : I think the most important of don't run your own crypto isn't that some other people are more competent (even if it is probably true) but mostly that everytime you do something you can make mistakes (being good or not don't change that).

A most correct form should be don't run not reviewed crypto.

Writing crypto shouldn't be different than writing other critical code but you shouldn't have confidence in your code before it had been reviewed.The quality of the review process is what give you confidence in a crypto code, for this reason new awesome revolutionary crypto isn't a thing people use and people prefer to wait that new technology have been reviewed before using it.

When you write your own crypto review process is something like i really think it work and roger read the whole code one time without finding any wulnerability so it is safe.

concerning how to learn about crypto:

  • read academic research concerning crypto
  • some university provide course (you can probably find course online)
  • reading and understand (how this happens not just the fact) known vulnerability

Not the answer you're looking for? Browse other questions tagged or ask your own question.