Re:An Empirical Study of Vulnerabilities in Cryptographic Li...
by lucb1e on Sunday July 25, 2021 @08:32AM
(#27948698)
That's how it always felt for me, yeah.
At peak, and in multiple independent courses, the teacher would step through a well-made AES key schedule visualization while none of us are (even planning on) doing the heavy math studies necessary to design a successor to or find vulnerabilities in something like AES. Most of us would be software engineers, sysadmins, or perhaps a handful of us might go into security fields like forensics or pentesting. The internals of AES are completely irrelevant. A curiosity maybe, but not something to be quizzed on. Then I went to do my master's and the teacher started about caesar ciphers...
All formal cryptography-for-non-cryptographers education I've ever had was completely useless (I was in tertiary education in the Netherlands between 2010 and 2018, in case anyone is wondering how dated this is).
The concept of authenticated encryption was mentioned in passing I think, though in one course I had to prompt the teacher to mention that as what you would want to be doing, but got far less attention or practice than doing things like a Caesar cipher or AES key schedule by hand.
Merely knowing that you have to look for the keyword authenticated encryption (when you want to do encryption for some reason) would already be enough in my opinion, from there you can find good answers. Or for secure connections, keyword searches should include something about key distribution/verification and, if you want to use something configurable like TLS, also configuration choices like enforcing allowed protocol versions. Which versions those are, that changes over time and there is little point memorizing it. You should just know that you should look into this when you need it.
At peak, and in multiple independent courses, the teacher would step through a well-made AES key schedule visualization while none of us are (even planning on) doing the heavy math studies necessary to design a successor to or find vulnerabilities in something like AES. Most of us would be software engineers, sysadmins, or perhaps a handful of us might go into security fields like forensics or pentesting. The internals of AES are completely irrelevant. A curiosity maybe, but not something to be quizzed on. Then I went to do my master's and the teacher started about caesar ciphers...
All formal cryptography-for-non-cryptographers education I've ever had was completely useless (I was in tertiary education in the Netherlands between 2010 and 2018, in case anyone is wondering how dated this is).
The concept of authenticated encryption was mentioned in passing I think, though in one course I had to prompt the teacher to mention that as what you would want to be doing, but got far less attention or practice than doing things like a Caesar cipher or AES key schedule by hand.
Merely knowing that you have to look for the keyword authenticated encryption (when you want to do encryption for some reason) would already be enough in my opinion, from there you can find good answers. Or for secure connections, keyword searches should include something about key distribution/verification and, if you want to use something configurable like TLS, also configuration choices like enforcing allowed protocol versions. Which versions those are, that changes over time and there is little point memorizing it. You should just know that you should look into this when you need it.