Skip to content
Go back

The golden rules of encryption for developers

Published: at 10:51 PM

It is easier to provide the list of things that are worth worrying about than it is to list the things that are safe. There are a lot of as-yet unbroken ciphers and constructions. So, here are the things to avoid:de the list of things that are worth worrying about than it is to list the things that are safe. There are a lot of as-yet unbroken ciphers and constructions. So, here are the things to avoid:

So far as I can tell, you are now fully briefed on the “distrusted” crypto. you are now fully briefed on the “distrusted” crypto.

Don’t build your own crypto. Use PGP for data at rest, TLS for data in motion, and NaCl for the rare in-between cases.rypto. Use PGP for data at rest, TLS for data in motion, and NaCl for the rare in-between cases.

Source @tptacek: https://news.ycombinator.com/user?id=tptacekps://news.ycombinator.com/user?id=tptacek](https://news.ycombinator.com/user?id=tptacek)

Update (2024)

Ten years on, many of the original recommendations still hold true. However, there have been advancements and changes in the field of cryptography:Ten years on, many of the original recommendations still hold true. However, there have been advancements and changes in the field of cryptography:

Overall, the principles of avoiding weak algorithms and not building custom cryptographic solutions remain crucial. Developers should stay informed about the latest cryptographic standards and best practices to ensure the security of their applications.


Suggest Changes

Previous Post
Powershell Power - Moving large amounts of files to the cloud
Next Post
The browser wars illustrated - playground edition