<story><title>How Not to Learn Cryptography (2014)</title><url>http://esl.cs.brown.edu/blog/how-not-to-learn-cryptography/</url></story><parent_chain><item><author>loup-vaillant</author><text>Cryptopals strikes me as a very good way of scaring people from not only inventing, but also &lt;i&gt;implementing&lt;/i&gt; their own crypto. It seems it&amp;#x27;s primary effect is to make people confident enough to repeat the &amp;quot;don&amp;#x27;t roll your own crypto&amp;quot; mantra to anyone who would listen.&lt;p&gt;Some people however don&amp;#x27;t really have a choice. &amp;quot;Just Libsodium&amp;quot; doesn&amp;#x27;t work on anything smaller than a Raspberry-Pi, or pretty much any embedded system out there. There are alternatives out there (shameless plug: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;monocypher.org&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;monocypher.org&lt;/a&gt;), but sometimes your only choice is to code and optimise it yourself.&lt;p&gt;Sometimes, your only reasonable choice is to implement your own crypto. And I can tell from experience, a few weeks of full time learning is enough to not shoot yourself in the foot. The trick is to learn the right things (not everybody can spend a few weeks with Dan Boneh), but if you limit yourself to simple primitives like Chacha20 and Curve25519, it&amp;#x27;s not that hard. (Fun fact: I did &lt;i&gt;not&lt;/i&gt; spend a few weeks with Dan Boneh, and I &lt;i&gt;did&lt;/i&gt; shoot myself in the foot once.)&lt;p&gt;Because let&amp;#x27;s be honest: you don&amp;#x27;t need to know all the attacks to protect yourself from them. What you need to know is the relevant &lt;i&gt;classes&lt;/i&gt; of attacks, and how to void them. For instance, all timing attacks are stopped if your code runs in constant time (which in practice mostly means without secret-dependent branches and without secret-dependent indices).</text></item><item><author>zeroxfe</author><text>I&amp;#x27;ve been working through the Cryptopals Crypto challenges (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;cryptopals.com&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;cryptopals.com&lt;/a&gt;) over the last month-and-a-half (almost done with Set 6), and they&amp;#x27;ve been extremely educational.&lt;p&gt;Attacks that I thought were just &amp;quot;theoretical&amp;quot; turned out to be very practical (sometimes even quite simple.) I&amp;#x27;ve always known that one shouldn&amp;#x27;t roll their own crypto because there&amp;#x27;s so many ways to shoot yourself -- but holy hell, executing some of these attacks really drive the point through.&lt;p&gt;(Also, I&amp;#x27;ve learned more number theory in the last few weeks than in my whole life!)&lt;p&gt;If anyone&amp;#x27;s interested, I&amp;#x27;ve been solving them in Go (which turned out to be surprisingly convenient for many reasons), and my solutions (so far) are here: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;0xfe&amp;#x2F;cryptopals&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;0xfe&amp;#x2F;cryptopals&lt;/a&gt;.</text></item></parent_chain><comment><author>zeroxfe</author><text>Thanks, I agree with almost all of this. I didn&amp;#x27;t mean to imply that Cryptopals is how you become a cryptographer, just that it&amp;#x27;s a fantastic way to get down and dirty with cryptography, and learn a ton.&lt;p&gt;These challenges are not easy, and you need some programming sophistication to get through them, since most of them require you to actually implement well-known primitives and algorithms (like Diffie-Hellman, RSA, DSA, PRNGs, etc.)&lt;p&gt;And to do that correctly, you end up studying a _lot_ of side material.&lt;p&gt;You do come out of the other end learning about various classes of attacks, but not necessarily how to avoid them -- that depends entirely upon your intellectual curiosity. :-)</text></comment>
<story><title>How Not to Learn Cryptography (2014)</title><url>http://esl.cs.brown.edu/blog/how-not-to-learn-cryptography/</url></story><parent_chain><item><author>loup-vaillant</author><text>Cryptopals strikes me as a very good way of scaring people from not only inventing, but also &lt;i&gt;implementing&lt;/i&gt; their own crypto. It seems it&amp;#x27;s primary effect is to make people confident enough to repeat the &amp;quot;don&amp;#x27;t roll your own crypto&amp;quot; mantra to anyone who would listen.&lt;p&gt;Some people however don&amp;#x27;t really have a choice. &amp;quot;Just Libsodium&amp;quot; doesn&amp;#x27;t work on anything smaller than a Raspberry-Pi, or pretty much any embedded system out there. There are alternatives out there (shameless plug: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;monocypher.org&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;monocypher.org&lt;/a&gt;), but sometimes your only choice is to code and optimise it yourself.&lt;p&gt;Sometimes, your only reasonable choice is to implement your own crypto. And I can tell from experience, a few weeks of full time learning is enough to not shoot yourself in the foot. The trick is to learn the right things (not everybody can spend a few weeks with Dan Boneh), but if you limit yourself to simple primitives like Chacha20 and Curve25519, it&amp;#x27;s not that hard. (Fun fact: I did &lt;i&gt;not&lt;/i&gt; spend a few weeks with Dan Boneh, and I &lt;i&gt;did&lt;/i&gt; shoot myself in the foot once.)&lt;p&gt;Because let&amp;#x27;s be honest: you don&amp;#x27;t need to know all the attacks to protect yourself from them. What you need to know is the relevant &lt;i&gt;classes&lt;/i&gt; of attacks, and how to void them. For instance, all timing attacks are stopped if your code runs in constant time (which in practice mostly means without secret-dependent branches and without secret-dependent indices).</text></item><item><author>zeroxfe</author><text>I&amp;#x27;ve been working through the Cryptopals Crypto challenges (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;cryptopals.com&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;cryptopals.com&lt;/a&gt;) over the last month-and-a-half (almost done with Set 6), and they&amp;#x27;ve been extremely educational.&lt;p&gt;Attacks that I thought were just &amp;quot;theoretical&amp;quot; turned out to be very practical (sometimes even quite simple.) I&amp;#x27;ve always known that one shouldn&amp;#x27;t roll their own crypto because there&amp;#x27;s so many ways to shoot yourself -- but holy hell, executing some of these attacks really drive the point through.&lt;p&gt;(Also, I&amp;#x27;ve learned more number theory in the last few weeks than in my whole life!)&lt;p&gt;If anyone&amp;#x27;s interested, I&amp;#x27;ve been solving them in Go (which turned out to be surprisingly convenient for many reasons), and my solutions (so far) are here: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;0xfe&amp;#x2F;cryptopals&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;0xfe&amp;#x2F;cryptopals&lt;/a&gt;.</text></item></parent_chain><comment><author>tptacek</author><text>What&amp;#x27;s rough about implementing your own crypto is that sometimes you screw it up, as you well know. When you screw up an attack, nobody suffers. Not so for novel implementations of primitives that you provide to others.</text></comment>