1
$\begingroup$

I'm not looking necessarily for implementations in any language (although it would help to list those resources as well), but what I am most interested in is a discussion of what advantages and disadvantages certain encryption methods have when applied to a given scenario. Just for a frame of reference:

  1. I want a user to enter a username/password that will be stored in a database.
  2. I want to encrypt a PDF file and send it to a friend and have her decrypt it.
  3. I need to encrypt a small amount of plain text and have someone else decrypt it.

I'm sure there are better examples, and there is sure to be some crossover, but it seems like much of the time spent on encryption is deciding what is the best method given the variables or scenario involved. Is it a one way hash? Do others need to decrypt it? Am I the only one to decrypt it? Is it binary or text? Are there file size limits? Is it stored, or sent over a network?

Improve this question
$\endgroup$
4
  • $\begingroup$ I disagree with the close vote as "list/recommendation" because the question is not about that. However your question seems a bit too broad. The answer to the username/password part is easily googleable (hint: look for KDFs especially on Sec.SE), and to the other two points the question is "it depends". Search for "symmetric vs asymmetric ciphers" for a quick look. I hope this helps. $\endgroup$
    – rath
    Commented Sep 25, 2013 at 1:46
  • $\begingroup$ For the password part, see How to securely hash passwords? on security.SE $\endgroup$
    – CodesInChaos
    Commented Sep 25, 2013 at 7:26
  • $\begingroup$ I think it's a fair question, when you look at it this way: what is a good approach to selecting cryptographic solutions? @RichieFrame 's answer below is a good one: start with a trustworthy document. $\endgroup$
    – John Deters
    Commented Sep 25, 2013 at 15:15
  • $\begingroup$ I know list questions are frowned upon because there is no "right" answer, but without detailing all the major scenarios for encrypting data and asking about each one this was about as specific as I could get. IMO it is better to list the resources that already do that. $\endgroup$
    – user8601
    Commented Sep 25, 2013 at 19:14

1 Answer 1

Reset to default
4
$\begingroup$

Start with NIST Computer Security Division:

FIPS (Federal Information Processing Standards) specifies multiple use scenarios in their Publications and Special Publications, many of which include the type of scenarios on your short list, as well as related scenarios. These are primarily for federal use, but if your use case matches that of the government their publications will apply.

Additionally, there are numerous books, including one called "Cryptography for Developers", which goes more into the application development side of implementing cryptographic systems. Niels Ferguson and Bruce Schneier of the Twofish team have written several books on practical design and implementation of cryptosystems that focus more on the cryptography side of things.

For more of of an open discussion try the sci.crypt newsgroup, where you can specify a specific scenario in detail and engage in debate; there are also other moderated locations to do this as well.

Hard as I try not to do the "list/recommendation" answer, thats kind of how it turned out, there really is not a better way to answer that broad of a question, individual questions on specific scenarios that are not answerable by the wiki/google method will provide more specific answers.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.