Follow

@alex_02@infosec.exchange @xabean

Soooo... I think I have bad news. I'm not a cryptography expert, but I do have the benefit of knowing more about it than 10 people picked randomly out of a crowd that isn't a cryptography convention (probably like many of you), so there's that.

Here's the thing. Public key cryptography (at least RSA, and I think in general by contrast to symmetric key) is slow, and it is deterministic.

The first isn't a big deal (ish) because computers are fast (you'll find that isn't as true as you'd like the first time you try to encrypt a particularly large file).

The second one will crush you, and is why cryptographers make the big bucks. The person who raised ECB vs. CBC (@xabean) wasn't wrong: see the picture in this wikipedia page to see what will happen to your data when there is too much repetition and you use a deterministic algorithm on it piecemeal: en.wikipedia.org/wiki/Block_ci

If your test for whether cryptography works is whether you recognize the data after it is transformed (hopefully not) and can return the data to its original form (hopefully), there are _lots_ of transformations that will qualify without protecting your information one whit.

I'd say that you'd be better off taking advantage of cryptography software written by experts (e.g. openssl or gpg) for this purpose. It will be faster and more secure, at the cost of being a slightly steeper learning curve than the program you wrote (but a much shallower learning curve than becoming a cryptography expert).

Sign in to participate in the conversation
Qoto Mastodon

QOTO: Question Others to Teach Ourselves
An inclusive, Academic Freedom, instance
All cultures welcome.
Hate speech and harassment strictly forbidden.