{"action":"created","comment":{"url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/pulls/comments/67694724","id":67694724,"diff_hunk":"@@ -0,0 +1,109 @@\n+---\n+layout: post\n+title: \"Tradeoffs in cryptographic API design\"\n+date: 2016-06-21 23:59\n+comments: false\n+author: lvh\n+published: true\n+categories:\n+    - security\n+---\n+\n+Producing cryptographic software is a difficult and specialized endeavor. One\n+of the pitfalls is that getting it wrong looks exactly like getting it\n+right. Much like a latent memory corruption bug or a broken distributed\n+consensus algorithm, a piece of cryptographic software can appear to be\n+functioning perfectly, while being subtly broken in a way that only comes to\n+light years later. As the adage goes, attacks never get worse; they only get\n+better. Implementation concerns like timing attacks can be fiendishly\n+complicated to solve, involving problems like division instructions on modern\n+Intel CPUs taking a variable number of cycles depending on the size of the\n+input. Implementation concerns aren't the only problem; just designing the\n+APIs themselves is a complex task as well.\n+\n+Like all API design, cryptographic API design is a user experience\n+exercise. It doesn't matter how strong or fast your cryptographic software is\n+if no one uses it. The people who end up with ECB mode didn't end up with it\n+because they understood what that meant. They got stuck with it because it was\n+the default and it didn't require thinking about scary parameters like IVs,\n+nonces, salts and tweaks. Even if someone ended up with CTR or CBC, these APIs\n+are still precarious; they'll still be vulnerable to issues like nonce\n+reuse, fixed IV, key-as-IV, unauthenticated encryption...\n+\n+User experience design always means deep consideration for who your users","path":"_posts/2016-06-21-tradeoffs-in-cryptographic-api-design.md","position":33,"original_position":33,"commit_id":"cbb952a0e84778db6f4824f833b030b1b58cc338","original_commit_id":"cbb952a0e84778db6f4824f833b030b1b58cc338","user":{"login":"catlook","id":5709104,"avatar_url":"https://avatars.githubusercontent.com/u/5709104?v=3","gravatar_id":"","url":"https://api.github.com/users/catlook","html_url":"https://github.com/catlook","followers_url":"https://api.github.com/users/catlook/followers","following_url":"https://api.github.com/users/catlook/following{/other_user}","gists_url":"https://api.github.com/users/catlook/gists{/gist_id}","starred_url":"https://api.github.com/users/catlook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/catlook/subscriptions","organizations_url":"https://api.github.com/users/catlook/orgs","repos_url":"https://api.github.com/users/catlook/repos","events_url":"https://api.github.com/users/catlook/events{/privacy}","received_events_url":"https://api.github.com/users/catlook/received_events","type":"User","site_admin":false},"body":"alternately:\r\nUser experience design always means deeply considering who your users","created_at":"2016-06-20T14:05:39Z","updated_at":"2016-06-20T14:05:39Z","html_url":"https://github.com/rackerlabs/docs-developer-blog/pull/213#discussion_r67694724","pull_request_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/pulls/213","_links":{"self":{"href":"https://api.github.com/repos/rackerlabs/docs-developer-blog/pulls/comments/67694724"},"html":{"href":"https://github.com/rackerlabs/docs-developer-blog/pull/213#discussion_r67694724"},"pull_request":{"href":"https://api.github.com/repos/rackerlabs/docs-developer-blog/pulls/213"}}},"pull_request":{"url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/pulls/213","id":74366914,"html_url":"https://github.com/rackerlabs/docs-developer-blog/pull/213","diff_url":"https://github.com/rackerlabs/docs-developer-blog/pull/213.diff","patch_url":"https://github.com/rackerlabs/docs-developer-blog/pull/213.patch","issue_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/issues/213","number":213,"state":"open","locked":false,"title":"Draft blog post: cryptographic API tradeoffs","user":{"login":"lvh","id":97816,"avatar_url":"https://avatars.githubusercontent.com/u/97816?v=3","gravatar_id":"","url":"https://api.github.com/users/lvh","html_url":"https://github.com/lvh","followers_url":"https://api.github.com/users/lvh/followers","following_url":"https://api.github.com/users/lvh/following{/other_user}","gists_url":"https://api.github.com/users/lvh/gists{/gist_id}","starred_url":"https://api.github.com/users/lvh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lvh/subscriptions","organizations_url":"https://api.github.com/users/lvh/orgs","repos_url":"https://api.github.com/users/lvh/repos","events_url":"https://api.github.com/users/lvh/events{/privacy}","received_events_url":"https://api.github.com/users/lvh/received_events","type":"User","site_admin":false},"body":"In my continuing mission to make the \"cryptography\" category a thing...\r\n\r\n - [x] Mini bio: can this be captured from previous blog post?\r\n - [x] Desired date of publishing: as per front matter, 2016-06-21\r\n - [x] Social media contact info: can this be captured from previous blog post?\r\n - [x] Redaction: yes, through this PR, although preferably not silently after publishing\r\n - [x] Comments: no\r\n\r\n@catlook Please review.\r\n\r\nI have also noticed that I'm not getting a gravatar in my blog posts. @smashwilson how do I make that happen?","created_at":"2016-06-19T16:00:34Z","updated_at":"2016-06-20T14:05:39Z","closed_at":null,"merged_at":null,"merge_commit_sha":"611a5e419cd1fa6922dc771180865b941439c0ac","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/pulls/213/commits","review_comments_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/pulls/213/comments","review_comment_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/pulls/comments{/number}","comments_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/issues/213/comments","statuses_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/statuses/cbb952a0e84778db6f4824f833b030b1b58cc338","head":{"label":"lvh:crypto-api-tradeoffs","ref":"crypto-api-tradeoffs","sha":"cbb952a0e84778db6f4824f833b030b1b58cc338","user":{"login":"lvh","id":97816,"avatar_url":"https://avatars.githubusercontent.com/u/97816?v=3","gravatar_id":"","url":"https://api.github.com/users/lvh","html_url":"https://github.com/lvh","followers_url":"https://api.github.com/users/lvh/followers","following_url":"https://api.github.com/users/lvh/following{/other_user}","gists_url":"https://api.github.com/users/lvh/gists{/gist_id}","starred_url":"https://api.github.com/users/lvh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lvh/subscriptions","organizations_url":"https://api.github.com/users/lvh/orgs","repos_url":"https://api.github.com/users/lvh/repos","events_url":"https://api.github.com/users/lvh/events{/privacy}","received_events_url":"https://api.github.com/users/lvh/received_events","type":"User","site_admin":false},"repo":{"id":41560864,"name":"docs-developer-blog","full_name":"lvh/docs-developer-blog","owner":{"login":"lvh","id":97816,"avatar_url":"https://avatars.githubusercontent.com/u/97816?v=3","gravatar_id":"","url":"https://api.github.com/users/lvh","html_url":"https://github.com/lvh","followers_url":"https://api.github.com/users/lvh/followers","following_url":"https://api.github.com/users/lvh/following{/other_user}","gists_url":"https://api.github.com/users/lvh/gists{/gist_id}","starred_url":"https://api.github.com/users/lvh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lvh/subscriptions","organizations_url":"https://api.github.com/users/lvh/orgs","repos_url":"https://api.github.com/users/lvh/repos","events_url":"https://api.github.com/users/lvh/events{/privacy}","received_events_url":"https://api.github.com/users/lvh/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/lvh/docs-developer-blog","description":"The developer.rackspace.com blog.","fork":true,"url":"https://api.github.com/repos/lvh/docs-developer-blog","forks_url":"https://api.github.com/repos/lvh/docs-developer-blog/forks","keys_url":"https://api.github.com/repos/lvh/docs-developer-blog/keys{/key_id}","collaborators_url":"https://api.github.com/repos/lvh/docs-developer-blog/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/lvh/docs-developer-blog/teams","hooks_url":"https://api.github.com/repos/lvh/docs-developer-blog/hooks","issue_events_url":"https://api.github.com/repos/lvh/docs-developer-blog/issues/events{/number}","events_url":"https://api.github.com/repos/lvh/docs-developer-blog/events","assignees_url":"https://api.github.com/repos/lvh/docs-developer-blog/assignees{/user}","branches_url":"https://api.github.com/repos/lvh/docs-developer-blog/branches{/branch}","tags_url":"https://api.github.com/repos/lvh/docs-developer-blog/tags","blobs_url":"https://api.github.com/repos/lvh/docs-developer-blog/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/lvh/docs-developer-blog/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/lvh/docs-developer-blog/git/refs{/sha}","trees_url":"https://api.github.com/repos/lvh/docs-developer-blog/git/trees{/sha}","statuses_url":"https://api.github.com/repos/lvh/docs-developer-blog/statuses/{sha}","languages_url":"https://api.github.com/repos/lvh/docs-developer-blog/languages","stargazers_url":"https://api.github.com/repos/lvh/docs-developer-blog/stargazers","contributors_url":"https://api.github.com/repos/lvh/docs-developer-blog/contributors","subscribers_url":"https://api.github.com/repos/lvh/docs-developer-blog/subscribers","subscription_url":"https://api.github.com/repos/lvh/docs-developer-blog/subscription","commits_url":"https://api.github.com/repos/lvh/docs-developer-blog/commits{/sha}","git_commits_url":"https://api.github.com/repos/lvh/docs-developer-blog/git/commits{/sha}","comments_url":"https://api.github.com/repos/lvh/docs-developer-blog/comments{/number}","issue_comment_url":"https://api.github.com/repos/lvh/docs-developer-blog/issues/comments{/number}","contents_url":"https://api.github.com/repos/lvh/docs-developer-blog/contents/{+path}","compare_url":"https://api.github.com/repos/lvh/docs-developer-blog/compare/{base}...{head}","merges_url":"https://api.github.com/repos/lvh/docs-developer-blog/merges","archive_url":"https://api.github.com/repos/lvh/docs-developer-blog/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/lvh/docs-developer-blog/downloads","issues_url":"https://api.github.com/repos/lvh/docs-developer-blog/issues{/number}","pulls_url":"https://api.github.com/repos/lvh/docs-developer-blog/pulls{/number}","milestones_url":"https://api.github.com/repos/lvh/docs-developer-blog/milestones{/number}","notifications_url":"https://api.github.com/repos/lvh/docs-developer-blog/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/lvh/docs-developer-blog/labels{/name}","releases_url":"https://api.github.com/repos/lvh/docs-developer-blog/releases{/id}","deployments_url":"https://api.github.com/repos/lvh/docs-developer-blog/deployments","created_at":"2015-08-28T17:42:27Z","updated_at":"2015-08-28T17:42:29Z","pushed_at":"2016-06-19T17:30:22Z","git_url":"git://github.com/lvh/docs-developer-blog.git","ssh_url":"git@github.com:lvh/docs-developer-blog.git","clone_url":"https://github.com/lvh/docs-developer-blog.git","svn_url":"https://github.com/lvh/docs-developer-blog","homepage":null,"size":64242,"stargazers_count":0,"watchers_count":0,"language":"HTML","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"rackerlabs:master","ref":"master","sha":"48a12f0617853a677f0121a36e418806ac64adab","user":{"login":"rackerlabs","id":84293,"avatar_url":"https://avatars.githubusercontent.com/u/84293?v=3","gravatar_id":"","url":"https://api.github.com/users/rackerlabs","html_url":"https://github.com/rackerlabs","followers_url":"https://api.github.com/users/rackerlabs/followers","following_url":"https://api.github.com/users/rackerlabs/following{/other_user}","gists_url":"https://api.github.com/users/rackerlabs/gists{/gist_id}","starred_url":"https://api.github.com/users/rackerlabs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rackerlabs/subscriptions","organizations_url":"https://api.github.com/users/rackerlabs/orgs","repos_url":"https://api.github.com/users/rackerlabs/repos","events_url":"https://api.github.com/users/rackerlabs/events{/privacy}","received_events_url":"https://api.github.com/users/rackerlabs/received_events","type":"Organization","site_admin":false},"repo":{"id":36315867,"name":"docs-developer-blog","full_name":"rackerlabs/docs-developer-blog","owner":{"login":"rackerlabs","id":84293,"avatar_url":"https://avatars.githubusercontent.com/u/84293?v=3","gravatar_id":"","url":"https://api.github.com/users/rackerlabs","html_url":"https://github.com/rackerlabs","followers_url":"https://api.github.com/users/rackerlabs/followers","following_url":"https://api.github.com/users/rackerlabs/following{/other_user}","gists_url":"https://api.github.com/users/rackerlabs/gists{/gist_id}","starred_url":"https://api.github.com/users/rackerlabs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rackerlabs/subscriptions","organizations_url":"https://api.github.com/users/rackerlabs/orgs","repos_url":"https://api.github.com/users/rackerlabs/repos","events_url":"https://api.github.com/users/rackerlabs/events{/privacy}","received_events_url":"https://api.github.com/users/rackerlabs/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/rackerlabs/docs-developer-blog","description":"The developer.rackspace.com blog.","fork":false,"url":"https://api.github.com/repos/rackerlabs/docs-developer-blog","forks_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/forks","keys_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/teams","hooks_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/hooks","issue_events_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/issues/events{/number}","events_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/events","assignees_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/assignees{/user}","branches_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/branches{/branch}","tags_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/tags","blobs_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/git/refs{/sha}","trees_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/statuses/{sha}","languages_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/languages","stargazers_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/stargazers","contributors_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/contributors","subscribers_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/subscribers","subscription_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/subscription","commits_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/commits{/sha}","git_commits_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/git/commits{/sha}","comments_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/comments{/number}","issue_comment_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/issues/comments{/number}","contents_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/contents/{+path}","compare_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/merges","archive_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/downloads","issues_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/issues{/number}","pulls_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/pulls{/number}","milestones_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/milestones{/number}","notifications_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/labels{/name}","releases_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/releases{/id}","deployments_url":"https://api.github.com/repos/rackerlabs/docs-developer-blog/deployments","created_at":"2015-05-26T18:34:01Z","updated_at":"2016-02-11T21:50:10Z","pushed_at":"2016-06-19T17:30:22Z","git_url":"git://github.com/rackerlabs/docs-developer-blog.git","ssh_url":"git@github.com:rackerlabs/docs-developer-blog.git","clone_url":"https://github.com/rackerlabs/docs-developer-blog.git","svn_url":"https://github.com/rackerlabs/docs-developer-blog","homepage":"https://developer.rackspace.com/blog/","size":65465,"stargazers_count":7,"watchers_count":7,"language":"HTML","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":46,"mirror_url":null,"open_issues_count":17,"forks":46,"open_issues":17,"watchers":7,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rackerlabs/docs-developer-blog/pulls/213"},"html":{"href":"https://github.com/rackerlabs/docs-developer-blog/pull/213"},"issue":{"href":"https://api.github.com/repos/rackerlabs/docs-developer-blog/issues/213"},"comments":{"href":"https://api.github.com/repos/rackerlabs/docs-developer-blog/issues/213/comments"},"review_comments":{"href":"https://api.github.com/repos/rackerlabs/docs-developer-blog/pulls/213/comments"},"review_comment":{"href":"https://api.github.com/repos/rackerlabs/docs-developer-blog/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/rackerlabs/docs-developer-blog/pulls/213/commits"},"statuses":{"href":"https://api.github.com/repos/rackerlabs/docs-developer-blog/statuses/cbb952a0e84778db6f4824f833b030b1b58cc338"}}}}
{"actor":{"display_login":"catlook"}}