Re: [boost] Crypto/hashes library?

Subject: Re: [boost] Crypto/hashes library?
From: degski (degski_at_[hidden])
Date: 2017-09-08 05:12:41

On 7 September 2017 at 18:08, Andrey Semashev via Boost <
boost_at_[hidden]> wrote:

> I think a full implementation of cryptographic algorithms in Boost, while
> would be nice in theory, is not very feasible in practice.
>

I agree with you, but for an important other reason, over and above the
ones you mention. Crypto is tricky businness. If you don't know what your
doing (and most people don't), things can go horribly wrong. Supplying the
building blocks for doing Crypto (as suggested in follow-up post to this
one) is not "safe". The way these alogo's get integrated in the code-base
is hugely important, problems like side channel attacks spring to mind,
it's a different way of thinking about algorithms.

I think an approach like the one of libsodium
<https://www.gitbook.com/book/jedisct1/libsodium/details> is the correct
one. Per "task" (let's say password authentication) to be done, there are 1
or 2 (full and complete) options on offer, options that do those things
well, and in a safe way. This approach, though, is contrary to boosts'
philosophy (offer all and every option, so the user can do things "his/her"
way). Another good crypto library is Botan <https://botan.randombit.net/>.
The code is well organised and easy to grasp and extend. Botan is slightly
easier to use than CryptoCpp IMO.

degski
-- 
"*Ihre sogenannte Religion wirkt bloß wie ein Opiat reizend, betäubend,
Schmerzen aus Schwäche stillend.*" - Novalis 1798