# Is it a requirement to understand mathematics when implementing (or breaking) cryptography? [duplicate]

In the context of putting crypto into applications, in a secure manner, could it be argued to achieve this (securely implementing a crypto system) you would require a thorough and rigorous understanding of the mathematics behind the crypto system?

Or, could it be said that this is more a matter of understanding how to code securely, as the cryptographic primitives themselves can already be securely implemented via libraries such as NaCl?

Edit: I realized the obvious, and in fact necessary, extension to this question. Reversing the goal, what level of mathematics would be required to break a crypto-system? On the one hand, heartbleed seemed to be a break in a crytpo-system but was in fact entirely based in (poor) code. On the other, the BREACH and CRIME compression side-channel attacks were very much discovered in the literature first. Am i answering my own question there?

• The obvious case is if you work on a crypto library, you need to be a cryptographer. If you've designing a protocol, you need to understand the primitives (crypto-engineer). If you're just using a library, you need to have a grasp of algorithm efficiency so you don't end up wasting CPU cycles. Now to use NaCl you need to understand the options offered to you (eg. GCM vs CFB), which brings us to the meat of the argument: Using securely implemented primitives doesn't mean that they're used right. So you need to know what you're coding and when to ask questions (which is why this site exists).
– rath
Jun 1, 2014 at 22:13
• one follow on question though, is regarding the second situation you described, understanding primitives to design a protocol, how much math would you say is required to safely undertake that? Jun 2, 2014 at 9:01
• Well, if you're just writing programs, it really depends what you're actually trying to do, but usually you don't need the math. Stick with the best-practices (using things like TLS or SSH, saving hashed and salted passwords only, etc.). However, if the security of the system is a critical aspect, you still want a cryptographer / security expert (at least in every piece of software where money is involved, e.g. auctions or banking).
– tylo
Jun 2, 2014 at 12:00
• @rath Well said, but working on a crypto lib is a bit overspecifying things. If you work on algorithm implementations would be better. Even then, there may be reference implementations available. Often it is of more use to have a good understanding on how to implement the ref. implementation on a specific platform (e.g. with regard to memory management) than a clear mathematical understanding of the the underlying primitives. Jun 3, 2014 at 11:14