Hacker News new | ask | show | jobs
by lvh 3490 days ago
Hi! I'm the author of Crypto 101.

Firstly, I'm a real, honest-to-God cryptographer. I don't know if there are any particular people you had in mind whose recommendations you'd like to see, but there are a few HN bigwigs who'd probably be willing to generally endorse it :-) Also, it's been posted on HN a few times before, so it's had some scrutiny. That doesn't mean I don't make mistakes, but generally speaking, an active reader should be OK.

The other thing is in the way the book is structured. I teach you to break crypto; so when I say something is broken, I prove it by showing you how to break it.

Finally, the goal of this book is absolutely not to help you implement DHE. In an ideal world, the primitives we offer people are hard to misuse. Crypto 101 then only exists to satisfy programmer curiosity. It is not a replacement for a traditional academic education that will help you design new primitives; it also doesn't show you how to write secure implementations. However, Crypto 101 is still useful beyond merely satisfying curiosity now, because most cryptographic libraries _do not_ provide that easy-to-use API. Using regular hashes for password storage, various forms of broken AES-CBC (unauthenticated, key=IV, static IV...), et cetera are very real problems for real code, and Crypto 101 teaches you how to avoid that minefield.

I'm also working on the "better, more accessible" crypto part, but I only have so much free time :)

2 comments

My trust chain: I don't know crypto and didn't know who you were (so I might have asked the same question) but a few days ago I found out you are involved with tptacek with latacora.com so that was all I needed to know and trust what you said.
I Ctrl-Fd "tptacek" as soon as I opened the page
That's a little scary but I appreciate the compliment.
It's sort of the HN version of 'yeah, he's a goodfella'.

Separately with latacora I suggest that you wrap in some ongoing residual that carries on far past the 'eventually you staff your own security team' phase (as added insurance for 'leadership').

Thanks! We're not looking to make money from clients in perpetuity. One of the things we like about the model is that we plan our own obsolescence and then get out of the way. It lines up our incentives.
Thanks for putting this together!

My g/f is getting interested in this sort of thing and she'll find this thrilling.