5
$\begingroup$

Related: What is the lowest level of mathematics required in order to understand how encryption algorithms work? and Recommended skills for a job in cryptology

In the context of putting crypto into applications, in a secure manner, could it be argued to achieve this (securely implementing a crypto system) you would require a thorough and rigorous understanding of the mathematics behind the crypto system?

Or, could it be said that this is more a matter of understanding how to code securely, as the cryptographic primitives themselves can already be securely implemented via libraries such as NaCl?

Edit: I realized the obvious, and in fact necessary, extension to this question. Reversing the goal, what level of mathematics would be required to break a crypto-system? On the one hand, heartbleed seemed to be a break in a crytpo-system but was in fact entirely based in (poor) code. On the other, the BREACH and CRIME compression side-channel attacks were very much discovered in the literature first. Am i answering my own question there?

Improve this question
$\endgroup$
4
  • 2
    $\begingroup$ The obvious case is if you work on a crypto library, you need to be a cryptographer. If you've designing a protocol, you need to understand the primitives (crypto-engineer). If you're just using a library, you need to have a grasp of algorithm efficiency so you don't end up wasting CPU cycles. Now to use NaCl you need to understand the options offered to you (eg. GCM vs CFB), which brings us to the meat of the argument: Using securely implemented primitives doesn't mean that they're used right. So you need to know what you're coding and when to ask questions (which is why this site exists). $\endgroup$
    – rath
    Jun 1, 2014 at 22:13
  • $\begingroup$ one follow on question though, is regarding the second situation you described, understanding primitives to design a protocol, how much math would you say is required to safely undertake that? $\endgroup$
    – AlexH
    Jun 2, 2014 at 9:01
  • $\begingroup$ Well, if you're just writing programs, it really depends what you're actually trying to do, but usually you don't need the math. Stick with the best-practices (using things like TLS or SSH, saving hashed and salted passwords only, etc.). However, if the security of the system is a critical aspect, you still want a cryptographer / security expert (at least in every piece of software where money is involved, e.g. auctions or banking). $\endgroup$
    – tylo
    Jun 2, 2014 at 12:00
  • $\begingroup$ @rath Well said, but working on a crypto lib is a bit overspecifying things. If you work on algorithm implementations would be better. Even then, there may be reference implementations available. Often it is of more use to have a good understanding on how to implement the ref. implementation on a specific platform (e.g. with regard to memory management) than a clear mathematical understanding of the the underlying primitives. $\endgroup$
    – Maarten Bodewes ♦
    Jun 3, 2014 at 11:14

1 Answer 1

Reset to default
4
$\begingroup$

I would say there are three general areas of necessary expertise for most crypto-related jobs:

  • Knowledge of primitives and their use cases.
  • Knowledge of protocols and understanding how to reason about their security.
  • Deep and abiding understanding of how incredibly stupid people are, including oneself.

The most that knowing the math is going to do for you practically, unless you are in academia/the NSA designing algorithms, is tell you "time to stop using RSA" on the day that you hear that there is a polynomial time factoring algorithm.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Indeed, the black hat talk "the coming cryptopocolypse" was the primary motivator for me wanting an answer to this question. With regards to crypto-engineering (what i think im mostly referring to when i say implementing crypto) to do this safely, it not longer seems enough to understand how a primitive works - most of the crypto breaks were known about in academic literature years before they become practical, in-the-wild threats (trying to find the source where i first read that, it was a comment by Thomas Ptacek). $\endgroup$
    – AlexH
    Jun 1, 2014 at 23:00
  • $\begingroup$ Please elaborate: Which primitives are you referring to exactly? $\endgroup$
    – Pacerier
    Dec 8, 2015 at 14:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.