Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I mean, say you were writing professional grade software that would involve sensitive client information. (Take this in the context of me being an amateur programmer.)

Would you use hlib and hmac? Are they good enough to secure data? Or would you write something fancier by hand?

Edit: In context of those libraries containing more or less the best hashing algorithms in the world, I guess it's silly to ask if you'd "write something fancier."

What I'm really asking here is whether it's enough on its own.

share|improve this question
2  
Good enough for what? Sensitive client information is incredibly vague, are we talking typical private data, financial data, or nuclear weapons launch codes? –  Yannis Rizos Nov 25 '12 at 9:37
    
LOL I meant...in general. Normal programming. Not the latter. –  Aerovistae Nov 25 '12 at 15:12
    
Not sure about how good they are but to answer the second question: would you write something fancier by hand? The answer to that is never. You (and I) are not security experts the chance of getting something subtle wrong is just too high. You should NEVER write your own encryption software (unless that is your specific job) always get a good well tested available package to do it. –  Loki Astari Nov 26 '12 at 1:26
add comment

1 Answer 1

up vote 3 down vote accepted

The pre-built library is almost certainly more secure than something you will write yourself. Writing security libraries like these is very difficult to do correctly without making any mistakes. The team of developers that made it probably have a lot more experience in this sort of thing than the average developer. Those libraries are also more "battle-tested" than something you'd write yourself. You should definitely use pre-build libraries instead of doing it yourself.

There's a lot to keep in mind when trying to do something securely though. It's possible to use the most secure tools and libraries, but combine them in a way that isn't secure. This is more likely than the core libraries themselves being insecure. This is why you want to keep everything as simple as possible, even when using secure libraries and tools.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.