On 7 September 2017 at 18:08, Andrey Semashev via Boost < boost@lists.boost.org> wrote:
I think a full implementation of cryptographic algorithms in Boost, while would be nice in theory, is not very feasible in practice.
I agree with you, but for an important other reason, over and above the ones you mention. Crypto is tricky businness. If you don't know what your doing (and most people don't), things can go horribly wrong. Supplying the building blocks for doing Crypto (as suggested in follow-up post to this one) is not "safe". The way these alogo's get integrated in the code-base is hugely important, problems like side channel attacks spring to mind, it's a different way of thinking about algorithms. I think an approach like the one of libsodium https://www.gitbook.com/book/jedisct1/libsodium/details is the correct one. Per "task" (let's say password authentication) to be done, there are 1 or 2 (full and complete) options on offer, options that do those things well, and in a safe way. This approach, though, is contrary to boosts' philosophy (offer all and every option, so the user can do things "his/her" way). Another good crypto library is Botan https://botan.randombit.net/. The code is well organised and easy to grasp and extend. Botan is slightly easier to use than CryptoCpp IMO. degski -- "*Ihre sogenannte Religion wirkt bloß wie ein Opiat reizend, betäubend, Schmerzen aus Schwäche stillend.*" - Novalis 1798