Hacker News new | ask | show | jobs
by richo 4081 days ago
If you believe that "don't roll your own crypto" is some kind of absurd mantra the security industry uses to keep us in business, I recommend that you roll your own crypto, and keep us in business.
4 comments

Schneier's Law comes to mind

"Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break."

https://www.schneier.com/blog/archives/2011/04/schneiers_law...

Oh, that's what that is!

I had found a similar thing making my own puzzles, "It's easy to make a puzzle you can't solve, but it's hard to make a puzzle that's fun."

Well, that' not entirely the same thing, but they overlap I guess.

I would compare it to a writer's inability to spot typos in something they wrote themselves. Probably, if the same algorithm was written by someone else, they could tear it apart easily.
I do not have concerns with the mantra itself just it's usage and the entitlement that often comes along with using it. The top answer on this Stack Exchange question is a good example of what I believe to be proper usage of the mantra. http://security.stackexchange.com/questions/18197/why-should...
How far should we take that maxim? It implies that no one should ever attempt this, but that leads to nothing new (unless you are first recognised as a crypto guru -- but how could you become one?).

I think it's worth drawing a distinction between the algos/maths and attempts at implementations. Otherwise we wouldn't have things like OCaml-TLS and others.

http://openmirage.org/blog/introducing-ocaml-tls

Implementations are even more sensitive to tiny bugs with huge consequences than algorithms. It's fine for people to write their own implementations if they're never used, but anything that will be used needs a large number of experts and a large amount of time before it should be trusted.
Maybe people can show new stuff they make on HN etc before using it in their apps.
HN is not and never will be an appropriate stage for cryptographic review.
it's like Pascal's Wager for security