Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I plan to build my own crypto library. The project will be primarily for me to learn (and if useful for no other purpose, that is fine). In the past I have implemented a few hashes, and AES quite a few times while learning about it, but those projects were solely for me to learn, not for any field use. With this one I'd like it to work on it as if it were be to used outside of myself.

I understand that using/implementing your own crypto is usually a bad idea (if not always), so the answer to how to approach this is always "just don't". What makes sense in my head is: if all the tests work, the implementations should be valid. So I guess what I mean to ask is, does matching all the test vectors mean my implementations are valid mathematically? Is implementing mathematics correctly not enough because there are other things I need to plan ahead for? I know pretty much nothing about side-channel attacks, so I don't know if that has to do with the primitives in use or the system using them.

tl;dr: I don't intend to put it into production, but I want to build as if I were, to learn.

share|improve this question
1  
just don't. I mean, yes, if everything passes the test vectors, there is a good chance the implementations are, functionally, correct. But you are ignoring side channel attacks, backdoors, performance, portability, ease of use, patents on algorithms, etc.. which require careful review by experienced people. So it would be at best unsafe to let other people use a hobby cryptography library. –  Thomas Mar 5 '13 at 22:29
    
If in an application that isn't a real-time system (encryption is on the user side, and takes a variable amount of time depending on the user's input), and performance was not an issue, would a functionally correct implementation be all that was necessary? I'm not trying to rationalize all the threats away, I just want to understand exactly what circumstances this kind of thing would be unsafe in. –  Payton Turnage Mar 5 '13 at 22:33
    
I suppose it would be, once you or someone else has gone over it and checked there is no suspicious code in it. But any realistic application is going to need at least performance, security, or certification, so there is no incentive to use an alternative library over, say, OpenSSL, or BouncyCastle, except in the most trivial of uses. There are a lot of subtle threats lurking around even this contrived scenario which I can't enumerate (correctly handling padding, etc..) and while it would be a good coding exercise - I did it myself a few months ago - I would not expect widespread use. –  Thomas Mar 5 '13 at 22:46
    
@PaytonTurnage - just for clarification, do you mean writing your own implementations from scratch (ie, from specs), or are you referring to porting code from one language to another? –  hunter Mar 6 '13 at 14:16
    
A famous saying is Tests can only prove existence of mistakes, not their absence (or something like that). With a theorem prover you could theoretically prove that your code matches a specification (but this takes work, and likely is less easy in C), but not that there are no side channel vulnerabilities. –  Paŭlo Ebermann Mar 6 '13 at 19:06

1 Answer 1

Does matching all the test vectors mean my implementations are valid mathematically?

Basically the comments got it, but test vectors are designed to attempt to hit lots of cases, but with high probability will not catch every single mistake. Should you do it? Definitely. Does it mean everything is perfect? No.

Is implementing mathematics correctly not enough because there are other things I need to plan ahead for?

Like you mention, side channel attacks are of concern. Another concern which has little to do with security is efficiency. That said, if your library is too slow, others might disable it. This could be developers or users (if that option exists in the software).

I am all for doing things for learning purposes. It is a good exercise and can teach a lot. I am a "do it to learn it" kind of person. So I don't want to discourage you from that. If projects you are writing need crypto, and they are to be used by others, you are probably better off using stuff that is out there and has presumably been reviewed by cryptographers.

share|improve this answer
    
Good answer. We can add a couple more implementation errors, which might be overlooked: Memory management can be a serious problem (one example would be to deallocate memory holding secret values), how "wrong input" is handled (e.g. if a function is called with null pointers, wrong data types, etc.), or if something bad happens if someone is able to inject some other kind of faults. –  tylo Jan 17 at 11:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.