Question

Background

With respect to cryptography in general, the following advice is so common that it may even be platform and language-agnostic.

Cryptography is an incredibly complex subject which developers should leave to security experts`

I understand and agree with the reasoning behind this statement, and therefore follow the advice when using cryptography in an application.

That being said, because cryptography is tread upon so lightly in all but crypto-specific reference material, I do not know enough about how cryptography works in order to be able to determine whether the default provided to me is adequate for the situation I’m in.There are thousands of crypto frameworks out there in a myriad of different languages, I refuse to believe that every one of those implementations is secure because I don’t believe every crypto implementation was created by a crypto expert, principally because if popular opinion is to be believed there just aren’t that many of them.

Question:

What information do I need to know about a given encryption algorithm to be able to determine for myself whether an algorithm is a reasonable choice?

Answer 1

• You need to know the current estimates of time-to-break for each algorithm variant.
• You need to know the certifications for particular libraries.
• You need to know the required effective security level for the data you are encrypting. Health information in the USA has particular requirements, for example. So do electric utilities.

The more technical you want to get with crypto algorithm evaluation, the more you are wanting the services of an expert. :-/

Consider http://www.cryptopp.com as an example of information provided. For instance, it is certified by NIST.