Netherlands / Haarlem
Security professional with many years of experience with the practical application of cryptographic algorithms and protocols. I'm helping with the design of protocols and API's within international standardization bodies. Over 30 years of general experience with computers, starting with MSX Basic at an early age.
I'm a professional user of Java and Java Card. I'm also proficient in XML, HTTP/HTML, Ant, Git, PKI, Linux (etc). I love trying out new languages, but I'm always returning to Java as it still seems the best language to develop secure applications.
Although I've studied computer science at the Vrije Universiteit, I'm mainly an autodidact.
If the code runs it does not mean it is secure. I would guess that about 10% of the code posted on StackOverflow could be secure.
If you want to learn cryptography I highly recommend Crypto I from Dan Boneh at Coursera as a (University level) introductory course.
The most common implementation mistake is treating binary as text and text as binary. So check if you correctly apply UTF-8 character encoding and base 64 encoding before asking a question. Validate that the received data, key and IV is identical (when converted to binary) during encryption and decryption.
Common security mistakes:
- using keys or IV's directly derived from text / passwords
- using ECB mode encryption
- using MD5, DES or other outdated cryptographic algorithms
- static IV's or IV's directly derived from the key
- performing password hashing (or key derivation) without applying PBKDF2, bcrypt or scrypt
- using ciphertext that is not protected by an authentication tag (as supplied by HMAC or GCM mode encryption)
- thinking that OTP (XOR-encryption) can be made secure (without reinventing a stream cipher)
- encryption without establishing trust (browser encryption)
- using textbook RSA or using RSA to encrypt a plaintext directly
- inventing transport based security instead of using (D)TLS
- not using a cryptographically secure random number generator
Worst documented API's (of well known libraries):
- CCCrypt - missing information and everything printed in Apple light-gray-on-white makes this API horrible to use - it doesn't even have a high page rank on Google
- (PHP's) mcrypt - I've rewritten the mcrypt_encrypt sample code, but it is still a complete mess and the API relies on an unmaintained C-library
- OpenSSL - this library has existed for as long as I can remember and the documentation is still full of holes
- Microsofts .NET classes - not responding to questions / requests while the API is just not describing what it really does
Get your act together guys!
Oh, yeah, and I like t-shirts too: #SOreadytohelp
Q&A for professional and enthusiast programmers
Q&A for software developers, mathematicians and others interested in cryptography
Q&A for information security professionals
Q&A for meta-discussion of the Stack Exchange family of Q&A websites
Q&A for computer enthusiasts and power users
Stack Exchange Network staging zone, where users come together to build new Q&A sites
Q&A for peer programmer code reviews
Q&A for Bitcoin crypto-currency enthusiasts
Q&A for professional programmers interested in conceptual questions about software development
Q&A for people studying math at any level and professionals in related fields
Q&A for science fiction and fantasy enthusiasts
Q&A for users of Linux, FreeBSD and other Un*x-like operating systems
Q&A for pro webmasters
Q&A for users of TeX, LaTeX, ConTeXt, and related typesetting systems
Q&A for professional mathematicians
Q&A for linguists, etymologists, and serious English language enthusiasts
Q&A for power users of web applications
Q&A for theoretical computer scientists and researchers in related fields
Q&A for users and developers of hardware and software for Raspberry Pi
Q&A for system and network administrators
Q&A for database professionals who wish to improve their database skills and learn from others in the community
Q&A for Ubuntu users and developers
Q&A for students, researchers and practitioners of computer science
Q&A for network engineers
Q&A for programming puzzle enthusiasts and code golfers
Q&A for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation
Q&A for parents, grandparents, nannies and others with a parenting role