Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Some nits:

* "Deep Crack" and Distributed.net came after DES was fatally injured by differential and linear cryptanalysis.

* At no point was the only alternative to the broken DES "Triple-DES"; we had (for instance) IDEA since 1991, which is what PGP used.

* Speed isn't the biggest reason we ditched DES-EDE; the tiny block size and key size restrictions are bigger reasons. Similarly, "at least as strong as Triple-DES" is misleading; nobody was satisfied with Triple-DES' security bounds.

Just nits. The AES math stuff is great. But don't go trying to use any of this; this is just a fraction of the detail you need to safely use an AES library.



What do you recommend as a good reference on implementing AES encryption?


There isn't one. Even _Practical Cryptography_, my favorite of the encryption books, misses details (some of them recent discoveries, others older) that can completely wreck the security of an application that depends on AES for security; also, as well-written as the book is, it's organized in a way that makes it possible to miss some of the key details that it does document.

If you need encryption in your application, you should use TLS or GPG/PGP to get it.


What about "Cryptography Engineering"?


It's effectively the exact same book as "Practical Cryptography". Get whichever is cheaper.



That's just a few of the issues; we wrote that to talk to other pentesters about how to look for flaws, not how to build something secure.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: