Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Some nits:

* "Deep Crack" and Distributed.net came after DES was fatally injured by differential and linear cryptanalysis.

* At no point was the only alternative to the broken DES "Triple-DES"; we had (for instance) IDEA since 1991, which is what PGP used.

* Speed isn't the biggest reason we ditched DES-EDE; the tiny block size and key size restrictions are bigger reasons. Similarly, "at least as strong as Triple-DES" is misleading; nobody was satisfied with Triple-DES' security bounds.

Just nits. The AES math stuff is great. But don't go trying to use any of this; this is just a fraction of the detail you need to safely use an AES library.



What do you recommend as a good reference on implementing AES encryption?


There isn't one. Even _Practical Cryptography_, my favorite of the encryption books, misses details (some of them recent discoveries, others older) that can completely wreck the security of an application that depends on AES for security; also, as well-written as the book is, it's organized in a way that makes it possible to miss some of the key details that it does document.

If you need encryption in your application, you should use TLS or GPG/PGP to get it.


What about "Cryptography Engineering"?


It's effectively the exact same book as "Practical Cryptography". Get whichever is cheaper.



That's just a few of the issues; we wrote that to talk to other pentesters about how to look for flaws, not how to build something secure.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: