Paul Maher's Blog : Do Developers need to understand Cryptography?

Monday, July 04, 2005 4:14 PM Paul Maher

Do Developers need to understand Cryptography?

Whether you are implementing an application that stores secrets on your machine, to anything such as using WS-Security or Secure Sockets to make your Web Service or Web Applications secure - the answer is YES...YES...YES!

We are living in a dangerous world, where one incorrect security decision could cost your company or even you, your livelihood.

Check out the following fantastic Cryptography Web Cast:
http://www.microsoft.com/uk/technet/itsshowtime/sessionh.aspx?videoid=17

This will be time well spent...

Comment Notification

If you would like to receive an email when updates are made to this post, please register here

Subscribe to this post's comments using RSS

Comments

# re: Do Developers need to understand Cryptography?

Monday, July 04, 2005 12:11 PM by LarryOsterman

IMHO, the answer is NO, NO, NO!

Why? Because developers who understand cryptography at anything other than the most basic level believe that they can actually make rational assumption about cryptography.

And they're totally, completely, and absolutely wrong.

Time and time again, developers who think they know enough about cryptography to go it on their own are found wrong. This has happened to Microsoft, it's happened to Netscape, it's happened to the OpenSSL people, it's happened to every single developer I know of who tried to roll their own crypto solution.

Crypto is too hard to leave to developers.

Developers should know just enough about cryptography to know that it's dangerous. They should stick to packages where someone else did the work. And then they should have their work reviewed by a real honest-to-god cryptographer (in the netscape example above, they implemented the crypto completely correctly, but they chose a weak IV for their channel, which renedered the entire crypto pointless).

Here there be dragons!

# re: Do Developers need to understand Cryptography?

Tuesday, July 05, 2005 11:21 AM by LarryOsterman

Drew asked me to post a followup.

It makes sense for a developer to understand relative strengths for crypto.

It also makes sense for a developer to have a basic understanding of how to use the crypto suites.

It certainly makes sense for a developer to know that MD5 is weaker than SHA, etc.

But developers need to understand that anything they do that involves crypto needs to be reviewed by a real professional cryptographer.

Or they're going to get it wrong.

# Should developers learn crypto?

Tuesday, July 05, 2005 1:35 PM by Larry Osterman's WebLog

Over the weekend, Paul Maher posted an article in which he asked if developers needed to understand cryptography....

# re: Do Developers need to understand Cryptography?

Wednesday, July 06, 2005 1:25 PM by Paul Maher

So when I chose the title, I wasn't expecting such passionate responses!

I should begin by clarifying, that even though I think it is a good thing that Developers understand crypto...I am not for one minute suggesting that they should do their own home baked version.

So with that clarified let's continue...

I am a great believer of people understanding the underpinning of the code that they write.

With crypto so prominent in our application development today (in some way or fashion), I feel justified in at least requesting that developers have a base understanding of some of the fundamentals.

That said I totally agree that the core policy decisions on what crpto to implement should be decided by a knowledgeable person, who has experience in this area.

So before I dig myself another hole...all I am saying is that self empowerment can only be good. But don't go off an implement your own crypto :-)

Please keep the comments coming,

Paul.

# Paul Maher s Blog Do Developers need to understand Cryptography | Quick Diets

Tuesday, June 09, 2009 6:46 AM by Paul Maher s Blog Do Developers need to understand Cryptography | Quick Diets

PingBack from http://quickdietsite.info/story.php?id=6201

Name (required)
Your URL (optional)
Comments (required)

Enter Code Here: Required
Remember Me?

Paul Maher's Blog

Search

Tags

News

Archives

Do Developers need to understand Cryptography?

Comment Notification

Comments

# re: Do Developers need to understand Cryptography?

# re: Do Developers need to understand Cryptography?

# Should developers learn crypto?

# re: Do Developers need to understand Cryptography?

# Paul Maher s Blog Do Developers need to understand Cryptography | Quick Diets

Leave a Comment