Re:Myths about /dev/urandom
by tedunangst on Tuesday September 01, 2015 @09:34AM
(#10152180)
Well, this is the point of nacl (and successors). You don't need to know that it's using a stream cipher. You only need to know you want to send a secret, and this is the function that does that.
How secret is it? How much effort do you want an adversary to spend vs. your intended recipient. How do you want to manage keys between yourself and the recipient? What is the size of the secret? How much do you trust the channels over which you are sending the message? Do you need to validate the identity of the secret's recipient? How many secrets do you need to send to how many recipients each minute?
All of these influence how the secret should be bundled up and sent, and it takes more than a library to pick the appropriate method.
Re:Myths about /dev/urandom
by tedunangst on Tuesday September 01, 2015 @11:33AM
(#10153053)
OK, I admit, if you like you can make it much harder than it needs to be.
About starting point, this is incredibly sad but true: there is no Applied Cryptography of 2015. The book is at this point in some way outdated and no replacement exists, however what you can do is to read it, and then to read the documents that there are around to get updated information. Also there are now the online courses on cryptography that really help. This may look like an overkill, but at this point crypto is everywhere and is the foundation of most things secure, so it is a requirement of everybody involved with computer security.