Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You shouldn't be rolling your own crypto primitives. You can completely implement the algorithm 100% 'correct' according to the research paper but introduce a side channel that could cause key extraction by an attacker. For instance, if it doesn't always take the exact same amount of time to process something, a timing attack can be used to figure out what the private key is.

Always use the battle tested implementation.

Power analysis, timing attacks, acoustic cryptanalysis, etc... there's many forms of side channel attacks that can be used to defeat a theoretically sound cryptosystem.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: