A cryptographic implementation is executable software that realizes an algorithm, construction, or protocol. It turns specifications into usable code, but mistakes in implementation or use can create devastating bugs. section 1.7 section 16.3
Treat an implementation as an engineering choice, not merely as a translation of mathematical ideas:
- Prefer a respected library that addresses the problem instead of implementing a primitive or protocol yourself. section 16.3 section 16.8
- Read the manual and verify when the primitive or protocol is safe to use; misuse causes many real-world failures. section 16.8
- Choose standards and interfaces that maximize interoperability and leave little room for users to make dangerous mistakes. section 1.7 section 16.8
- Test implementations with targeted tooling such as Google’s Wycheproof, which supplies test vectors for tricky bugs in algorithms including ECDSA and AES-GCM. section 16.3
From idea to application
A cryptographic concept can become an algorithm in a white paper, a standardized construction, and then a library implementation in several programming languages. An application developer uses that library; choosing a respected implementation is safer than assembling primitives independently. section 1.7 section 16.8
Figure 1.16 The ideal life cycle for a cryptographic algorithm starts when cryptographers instantiate a concept in a white paper. For example, AES is an instantiation of the concept of symmetric encryption (there are many more symmetric encryption algorithms out there). A construction can then be standardized: everybody agrees to implement it a certain way to maximize interoperability. Then support is created by implementing the standard in different languages.
Follow the lifecycle from a cryptographic concept through an algorithm, standardization, and implementations in different languages. section 1.7
