Bryan Woods bwoods

Cryptographic Best Practices

Putting cryptographic primitives together is a lot like putting a jigsaw puzzle together, where all the pieces are cut exactly the same way, but there is only one correct solution. Thankfully, there are some projects out there that are working hard to make sure developers are getting it right.

The following advice comes from years of research from leading security researchers, developers, and cryptographers. This Gist was [forked from Thomas Ptacek's Gist][1] to be more readable. Additions have been added from

Since http://stillmaintained.com is, ironically, no longer maintained, here's some custom GitHub badges for your dead, stale, or frozen projects:

: https://img.shields.io/badge/maintained%3F-no!-red.svg?style=flat
: https://img.shields.io/badge/maintained%3F-seeking:_help_me!-yellow.svg?style=flat
: https://img.shields.io/badge/maintained%3F-rapidly_changing!-orange.svg?style=flat
: https://img.shields.io/badge/maintained%3F-yes!-brightgreen.svg?style=flat
: https://img.shields.io/badge/maintained%3F-feature--frozen-lightgrey.svg?style=flat

You can modify these using [Shields.

Hello software developers,

Please check your code to ensure you're not making one of the following mistakes related to cryptography.

I. General Mistakes

Writing your own home-grown cryptography primitives (For example: Mifare Classic)
- Exception: For the sake of learning, but don't deploy it in production.
Using a fast hash function (e.g. MD5, SHA256) for storing passwords. Use bcrypt instead.
Not using a cryptographically secure random number generator

	# Sample toolchain file for building for Windows from an Ubuntu Linux system.
	#
	# Typical usage:
	# *) install cross compiler: `sudo apt-get install mingw-w64`
	# *) cd build
	# *) cmake -DCMAKE_TOOLCHAIN_FILE=~/mingw-w64-x86_64.cmake ..
	# This is free and unencumbered software released into the public domain.

	set(CMAKE_SYSTEM_NAME Windows)
	set(TOOLCHAIN_PREFIX x86_64-w64-mingw32)

	#include <iostream>
	#include <fstream>
	#include <vector>
	#include <string>
	#include <algorithm>
	#include <chrono>
	#include <functional>

	#define GLFW_INCLUDE_VULKAN
	#include <GLFW/glfw3.h>

	/*
	Just like integer division, these functions round down to an integer.
	Running this program should produce the following output:

	sqrt(3735928559) == 61122
	61122^2 == 3735898884
	sqrt(244837814094590) == 15647294
	15647294^2 == 244837809522436

	This algorithm comes from Jack W. Crenshaw's 1998 article in Embedded:

	WITH RECURSIVE
	unhex(str, val, weight) AS (
	SELECT 'deadbeef', 0, 1
	UNION ALL
	SELECT
	substr(str, 1, length(str) - 1),
	val + (instr('0123456789ABCDEF', substr(str, length(str), 1)) - 1) * weight,
	weight * 16
	FROM unhex WHERE length(str) > 0
	)

	import Foundation

	// Why bytesView rather than just extending NSData directly?
	// Because this way we can keep our extension internal and not conflict
	// with someone who imports us and has also extended NSData.
	// If you're top-level code, you can just hoist everyting up to NSData directly.
	internal extension NSData {
	var bytesView: BytesView { return BytesView(self) }
	}

	/**
	Defines a user defined literal that can create std::integral_constant values.

	http://blog.mattbierner.com/stupid-template-tricks-stdintegral_constant-user-defined-literal/
	*/
	constexpr unsigned digit_to_value(char c) {
	if (c >= 'a' && c <= 'f') return c - 'a' + 10;
	else if (c >= 'A' && c <= 'F') return c - 'A' + 10;
	else if (c >= '0' && c <= '9') return c - '0';
	else throw std::invalid_argument("c");

	// Sean Parent. Inheritance Is The Base Class of Evil. Going Native 2013
	// Video: https://www.youtube.com/watch?v=bIhUE5uUFOA
	// Code : https://github.com/sean-parent/sean-parent.github.io/wiki/Papers-and-Presentations

	/*
	Copyright 2013 Adobe Systems Incorporated
	Distributed under the MIT License (see license at
	http://stlab.adobe.com/licenses.html)

	This file is intended as example code and is not production quality.