Chapter 1 of 6 · 4 practices · 5 min · 4-question quiz
Choosing the right tool and library
Before writing any crypto code, decide which property you need (secrecy, integrity, authenticity) and use a high-level library that gives you exactly that.
Start: Never design your own algorithm, mode or protocol4 practices in this chapter
- 1Never design your own algorithm, mode or protocolOWASP's Cryptographic Storage Cheat Sheet answers the question of custom algorithms in three words: "Don't do this." The same applies to custom modes, padding schemes, token formats and handshakes…
- 2Use a high-level library such as libsodium, Tink or your platform's vetted APIHigh-level libraries remove the decisions that cause most mistakes. Google's Tink describes itself in terms of primitives defined by the security properties they satisfy, and its AEAD interface does…
- 3Know when to hash, encrypt, MAC or signMany bugs come from using the right algorithm for the wrong job, such as hashing a webhook body when you needed to prove who sent it. Pick by the property you need: A few rules fall out of the table…
- 4Compare MACs, tokens and signatures in constant timeA normal string comparison stops at the first byte that differs. Measured over many requests, that timing difference can let an attacker guess a valid MAC or token one byte at a time. Whenever you…
Check yourself on this chapter
4 questions, right here once you are signed in. Your progress is saved as you read.