Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 2 down vote favorite

I plan to build my own crypto library. The project will be primarily for me to learn (and if useful for no other purpose, that is fine). In the past I have implemented a few hashes, and AES quite a few times while learning about it, but those projects were solely for me to learn, not for any field use. With this one I'd like it to be useful outside of myself if at all possible, and potentially use it in my own programs.

Now, I understand that using/implementing your own crypto is usually a bad idea (if not always), so I figure the answer to this is probably "just don't". However what makes sense in my head is: if all the tests work, the implementations should be valid. So I guess what I mean to ask is, does matching all the test vectors mean my implementations are valid mathematically? Is implementing mathematics correctly not enough because there are other things I need to plan ahead for? I know pretty much nothing about side-channel attacks, so I don't know if that has to do with the primitives in use or the system using them.

I wouldn't consider it normally, but C doesn't have a lot of crypto "toolkits" available, and the most popular one (libtomcrypt) appears to be made as a hobby project too (might be wrong on that notion).

share|improve this question
1  
just don't. I mean, yes, if everything passes the test vectors, there is a good chance the implementations are, functionally, correct. But you are ignoring side channel attacks, backdoors, performance, portability, ease of use, patents on algorithms, etc.. which require careful review by experienced people. So it would be at best unsafe to let other people use a hobby cryptography library. – Thomas Mar 5 at 22:29
If in an application that isn't a real-time system (encryption is on the user side, and takes a variable amount of time depending on the user's input), and performance was not an issue, would a functionally correct implementation be all that was necessary? I'm not trying to rationalize all the threats away, I just want to understand exactly what circumstances this kind of thing would be unsafe in. – Payton Turnage Mar 5 at 22:33
I suppose it would be, once you or someone else has gone over it and checked there is no suspicious code in it. But any realistic application is going to need at least performance, security, or certification, so there is no incentive to use an alternative library over, say, OpenSSL, or BouncyCastle, except in the most trivial of uses. There are a lot of subtle threats lurking around even this contrived scenario which I can't enumerate (correctly handling padding, etc..) and while it would be a good coding exercise - I did it myself a few months ago - I would not expect widespread use. – Thomas Mar 5 at 22:46
@PaytonTurnage - just for clarification, do you mean writing your own implementations from scratch (ie, from specs), or are you referring to porting code from one language to another? – hunter Mar 6 at 14:16
A famous saying is Tests can only prove existence of mistakes, not their absence (or something like that). With a theorem prover you could theoretically prove that your code matches a specification (but this takes work, and likely is less easy in C), but not that there are no side channel vulnerabilities. – Paŭlo Ebermann♦ Mar 6 at 19:06
show 1 more comment

1 Answer

up vote 4 down vote

Does matching all the test vectors mean my implementations are valid mathematically?

Basically the comments got it, but test vectors are designed to attempt to hit lots of cases, but with high probability will not catch every single mistake. Should you do it? Definitely. Does it mean everything is perfect? No.

Is implementing mathematics correctly not enough because there are other things I need to plan ahead for?

Like you mention, side channel attacks are of concern. Another concern which has little to do with security is efficiency. That said, if your library is too slow, others might disable it. This could be developers or users (if that option exists in the software).

I am all for doing things for learning purposes. It is a good exercise and can teach a lot. I am a "do it to learn it" kind of person. So I don't want to discourage you from that. If projects you are writing need crypto, and they are to be used by others, you are probably better off using stuff that is out there and has presumably been reviewed by cryptographers.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.