Date sent: Mon, 12 Dec 2005 00:41:13 -0600 From: "Travis H." <[EMAIL PROTECTED]> To: cryptography@metzdowd.com Subject: crypto for the average programmer
> In Peter Gutmann's godzilla cryptography tutorial, he has some really > good (though terse) advice on subtle gotchas in using DH/RSA/Elgamal. > I learned a few no-nos, such as not sending the same message to 3 > seperate users in RSA (if using 3 as an encryption exponent). > > My question is, what is the layperson supposed to do, if they must use > crypto and can't use an off-the-shelf product? Is there any site > tracking such gotchas as they show up in the literature? Are there > APIs written specifically so that a crypto-naive programmer can safely > use them? It seems to me that if the only thing you use public key encryption for is to encrypt a single use randomly chosen symmetric key, and integrity bits for that key, and if you then use that symmetric key once and only once, to encrypt a message that already contains integrity checking and a unique random number, you don't need to worry about those issues. Of course those issues reappear when using public keys for signature algorithms - so don't invent your own signature protocol. Signatures are hard. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]