0
$\begingroup$

I have some understanding of Cryptography and I would like to know if there is a tool or website to help me choose an algorithm based on my own needs (I'm being vague in purpose).

I'm looking for a website or tool that shows properties of algorithms like:

  • What is it best for
  • What is it not very good for
  • How can it be used poorly
  • What kind of algorithm is it? (hash, encryption, etc)
  • Is it reversible?
  • Is it symmetric or asymmetric?
  • Does it have known vulnerabilities?
  • How strong is it against brute force?
  • How proven is it in the industry?
  • When was it invented?
  • Is it fast to run? To decrypt (as appropriate)?
  • How common are implementations of it in various languages?
  • What programming languages have implementations currently?

I specifically want information to help me choose the appropriate algorithm based on my needs, not just encyclopedic information about algorithms. And for vulnerabilities, a resource that is maintained and updated would also be invaluable.

Perhaps all this information does not reside in one place, but I'm not really sure where to even start (other than just googling 'how to choose an encryption algorithm' and etc) to research this information.

Edit: Adding some links to articles

Improve this question
$\endgroup$
9
  • 4
    $\begingroup$ Wikipedia, probably. I don't now of any website that tabulates all this information in such detail. $\endgroup$
    – wyas
    Feb 24, 2015 at 18:29
  • 1
    $\begingroup$ If You’re Typing the Letters A-E-S Into Your Code You’re Doing It Wrong. That being said, you do need to know how to choose algorithms if you're designing protocols, but there's no miracle: you need to study the topic for a while before you can make design decisions. $\endgroup$
    – Gilles 'SO- stop being evil'
    Feb 25, 2015 at 6:10
  • 3
    $\begingroup$ "The most important and difficult part is checking to see if there are known vulnerabilities"; actually, no, that's the easy part. The hardest (and most important) part is to make sure that you're using them securely, and in a way that covers all the security concerns in your attack model. $\endgroup$
    – poncho
    Feb 26, 2015 at 18:26
  • 3
    $\begingroup$ @Nate you think you know enough, but in fact if you think system design is easy given a generic list of properties, that's a sign that you don't know enough to do it right. $\endgroup$
    – cpast
    Feb 27, 2015 at 1:22
  • 1
    $\begingroup$ Can't vote to close this any more, due to the bounty. Funny enough, my close reason would be the exactly opposite of the little explanation box below the bounty: Question way too broad/unspecific/can't be answered. $\endgroup$
    – tylo
    Feb 27, 2015 at 14:14

2 Answers 2

Reset to default
1
+50
$\begingroup$

There is no out of the box tester which can tell you what you need, you need to do research. I'm having the same 'problem'. I'm doing an internship for a company which wants to protect their self-created protocol which works on top of TCP.

So to tackle this I've create a plan of approach and defined my research parameters (quite broadly). Now i'm looking into the history of several algorithms (RC6, AES, Twofish) and looking which is best applicable to my situation.

Since i have hardware restrictions (it's for embedded use and some embedded divces they use are OLD) so I'm currently looking into libraries such as PolarSSL to find C implementations of cryptographic algorithms to test on the embedded devices i have.

When i test them i'll test for speed, code space and other things.

So in short, what you need all depends on what you need, maybe TDES even though it's old and almost insecure is what you need. but you need to do your own research.

As far as good implementations are concerned, open source libraries is the way to go. They are used world wide and it is safe to say well known open source libraries have been tested to an extend no stack overflow solution has (given the solution isn't a direct copy of an open source library :P )

But for all your questions these websites are for your best research:

  • NIST publications, proven secure algorithms (no implementations but lots of background)
  • Wikipedia, General background and specifications
  • PolarSSL Source code in C
  • For implementations in for example c# the .net library has everything you could possible need.

So final note do not create your own implementation! use the libraries but that's a disclaimer everyone should know by now :P

Improve this answer
$\endgroup$
4
  • $\begingroup$ So they want to protect their self-created (probably confidential, no open-source) protocol with GPL libraries (PolarSSL) ? $\endgroup$
    – Ruggero
    Feb 27, 2015 at 10:18
  • $\begingroup$ Well they want to protect it, i am here to figure out what the bes way to do this is, providing privacy and authentication. I am leaning towards AES-gcm and probbably want to use the implementation from the POLARSSL library. but i'm still in the research fase and it is still a possibility to completely use an TLS version. Is there something wrong with using open source libraries such as PolarSSL? btw this is hugely off topic, but if you care to help me a PM would truly be appreciated :) $\endgroup$
    – Vincent
    Feb 27, 2015 at 11:11
  • $\begingroup$ You got the basic message right in your last paragraph, but having a "secure proprietary protocol" designed by non-experts is the little sister of that same mantra. More often than not, a proprietary protocol is chosen to actually have security through obscurity. Tbh: If they have an intern working on the security of a protocol, then it is quite likely, that a) it was not designed with security in mind and b) no expert was involved or has analyzed it. If companies don't invest real money/time in security, most likely they end up with something badly flawed - and can only hope no one notices. $\endgroup$
    – tylo
    Feb 27, 2015 at 14:12
  • $\begingroup$ thanks for believing in me :P but I am on my way to become an 'expert' and what i make will be heavily tested by companies like foxIT. So they do take their security serious (more than they did with the protocol which was indeed security through obscurity) $\endgroup$
    – Vincent
    Mar 2, 2015 at 7:13
0
$\begingroup$

This question is more or less completely answered on one of our favorite sites for information. For algorithm-specific questions (when was it invented, vulnerabilities, etc.), just click on the specific hashing algorithm on that page.

"What is it best for" - all hashing algorithms are designed to be a one-way function, and all encryption algorithm are designed to be reversible. This is what they are best for, respectively.

"What is it not very good for" - a hashing algorithm is not good for the job of an encryption algorithm, and vice versa.

Therefore, if your goal is to hash something, any (strong) hashing algorithm should do the job just fine. The same goes for if your goal is to encrypt (and later decrypt) something.

Some of your questions are not as easy to answer and would require some serious digging, without the guarantee of an accurate answer, such as "How common are implementations of it in various languages?"

There are plenty of posts on Stack Exchange about whether certain algorithms are strong or not, and Wikipedia gives the historical background to most of that as well. Between the two you should find what you're looking for.

Improve this answer
$\endgroup$
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.