<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Mike,</div><div><br></div><div>I agree that only security experts should implement production ciphers. But as Lewis pointed out, the OP's stated intention is to create a demo from scratch. This is what I think is worth doing and <u>only</u> for private distribution.</div><div><br></div><div>Publishing that demo or distributing it widely would be unwise, to say the least. In that case, I would totally echo your words. Paraphrasing Matthew D Green, we don't need to add more stupid to the Internet.</div><div><br></div><div>I'm advocating for the opportunity to learn from some of the best people in the field, not for adding noise to the misinformation out there.</div><div><br>On May 12, 2015, at 12:24 AM, Lewis Rosenthal <<a href="mailto:lgrosenthal@2rosenthals.com">lgrosenthal@2rosenthals.com</a>> wrote:<br><br></div><blockquote type="cite"><div><span>Hi, all...</span><br><span></span><br><span>I think it wise to go back to the OP's stated objective, to create "an independent to libraries source code for demonstration purposes for AES-CTR mode." The operative prepositional phrase here being "for demonstration purposes."</span><br><span></span><br><span>Thus, whether it is wise to implement one's own crypto library/engine/etc. in *production*, I see no particular reason why learning from creating one as a demonstration or proof of concept (and even providing such code here or elsewhere for critique) is such a bad thing.</span><br><span></span><br><span>This list is replete with experienced practitioners. If this isn't a good place to critique such a demonstration or proof of concept, perhaps someone here knows of a better list (one perhaps not focused on using OpenSSL in particular, say <a href="http://crypto.stackexchange.com">crypto.stackexchange.com</a> - adn that is not an endorsement, merely an example).</span><br><span></span><br><span>On 05/11/2015 11:59 PM, Mike Mohr wrote:</span><br><blockquote type="cite"><span>If you don't know about list comprehension in Python, you can simply construct a list in a loop to get the job done. The end result is the same no matter which approach you take.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>The same is not true for cryptography. While Sec_Aficionado is quite eloquent and makes several valid points, I think his overall argument does not hold water. I have audited the crypto implementations in a number of open-source projects over the years found wide variance in their quality. In one instance a popular piece of software included a feature which claimed to encrypt its data using AES-256. It turned out that the code copied the user's password directly into the key buffer, either padding with null bytes or truncating depending on the length. The data was then encrypted using AES-256 in ECB mode. The software's primary purpose was not cryptography, and it provided innovative and creative features otherwise. This type of bug is insidious, since it doesn't really protect the data in any meaningful way and lulls its users into a false sense of security.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>I am not advocating that the realm of information security be forever relegated to a select few. That is also dangerous, as Sec_Aficionado correctly pointed out. However, the study of cryptography should never be undertaken without the guidance of an experienced practitioner. I had the extraordinary opportunity to study information security at university under the guidance of an ex-NSA analyst. I recognize that I am extremely lucky to have had this chance, and that this kind of education is only available to a select set of people worldwide. I also don't have a solution to the problem of training the next generation of cryptographers. However, having yet another potentially compromised AES implementation written by a novice programmer is not something that I want to encourage.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>On Mon, May 11, 2015 at 6:12 AM, Sec_Aficionado <<a href="mailto:secaficionado@gmail.com">secaficionado@gmail.com</a> <<a href="mailto:secaficionado@gmail.com">mailto:secaficionado@gmail.com</a>>> wrote:</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span> While implementing one's own security and/or cryptography is</span><br></blockquote><blockquote type="cite"><span> certainly not advisable for a novice (or even advanced</span><br></blockquote><blockquote type="cite"><span> programmers), creating cipher implementations from scratch is</span><br></blockquote><blockquote type="cite"><span> probably one of the best ways to learn and understand the</span><br></blockquote><blockquote type="cite"><span> intricacies of the problem at hand.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span> Learning about the pitfalls and advantages of the algorithms is</span><br></blockquote><blockquote type="cite"><span> key for a future security expert. Moreover, denying someone access</span><br></blockquote><blockquote type="cite"><span> to help on an open source project is antithetical to the OSS</span><br></blockquote><blockquote type="cite"><span> philosophy. How can anyone hope to understand code that by its</span><br></blockquote><blockquote type="cite"><span> very nature is cryptic and complex if there's no one willing to</span><br></blockquote><blockquote type="cite"><span> help disentangle, at least at a high level, the routines and</span><br></blockquote><blockquote type="cite"><span> functions?</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span> InfoSec is a black art today, but it needs to get out of that</span><br></blockquote><blockquote type="cite"><span> mode. After the last few years it is clear that unless we open up</span><br></blockquote><blockquote type="cite"><span> the understanding of these disciplines, we will be at the mercy of</span><br></blockquote><blockquote type="cite"><span> experts with hidden agendas. Only educated users can hope to make</span><br></blockquote><blockquote type="cite"><span> correct use of cryptography, or be able to choose the best</span><br></blockquote><blockquote type="cite"><span> application for their needs. As we know, even a robust cipher is</span><br></blockquote><blockquote type="cite"><span> useless if utilized for the wrong purpose or poorly configured. We</span><br></blockquote><blockquote type="cite"><span> can't turn away those with a genuine interest in learning how to</span><br></blockquote><blockquote type="cite"><span> use cryptography without dooming ourselves to continue with the</span><br></blockquote><blockquote type="cite"><span> status quo.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span> I appeal to those of you who routinely share your knowledge and</span><br></blockquote><blockquote type="cite"><span> try to make a difference here, that you provide some guidance and</span><br></blockquote><blockquote type="cite"><span> not turn away people with basic questions like this one. These are</span><br></blockquote><blockquote type="cite"><span> the users who may become one day contributors. They should be</span><br></blockquote><blockquote type="cite"><span> nurtured and not shunned.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span> OK, I'll get off my soapbox now. Have a great week everyone.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span> On May 10, 2015, at 5:58 PM, Mike Mohr <<a href="mailto:akihana@gmail.com">akihana@gmail.com</a></span><br></blockquote><blockquote type="cite"><span> <<a href="mailto:akihana@gmail.com">mailto:akihana@gmail.com</a>>> wrote:</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><blockquote type="cite"><span> The task of implementing AES should not be undertaken by a novice</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span> programmer. Please save the world another heartbleed and pick</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span> something more in line with your skill level.</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span></span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span> On May 10, 2015 11:48 AM, "konstantinos Alexiou"</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span> <<a href="mailto:konstantinakos.a@gmail.com">konstantinakos.a@gmail.com</a> <<a href="mailto:konstantinakos.a@gmail.com">mailto:konstantinakos.a@gmail.com</a>>></span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span> wrote:</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span></span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span> Dear Sirs,</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span></span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span></span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span> I am new to C programming and i am trying to create an</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span> independent to libraries source code for demonstration</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span> purposes for AES-CTR mode.Could i have some help on doing</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span> that using the source code contained under crypto/aes.</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span></span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span></span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span> Thank you very much in advance.</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span></span><br></blockquote></blockquote><span></span><br><span>-- </span><br><span>Lewis</span><br><span>-------------------------------------------------------------</span><br><span>Lewis G Rosenthal, CNA, CLP, CLE, CWTS, EA</span><br><span>Rosenthal & Rosenthal, LLC <a href="http://www.2rosenthals.com">www.2rosenthals.com</a></span><br><span>visit my IT blog <a href="http://www.2rosenthals.net/wordpress">www.2rosenthals.net/wordpress</a></span><br><span>IRS Circular 230 Disclosure applies see <a href="http://www.2rosenthals.com">www.2rosenthals.com</a></span><br><span>-------------------------------------------------------------</span><br><span></span><br><span>_______________________________________________</span><br><span>openssl-users mailing list</span><br><span>To unsubscribe: <a href="https://mta.openssl.org/mailman/listinfo/openssl-users">https://mta.openssl.org/mailman/listinfo/openssl-users</a></span><br></div></blockquote></body></html>