I\'m making a C++ back end for an application that\'ll heavily rely on AES-256 a

Question

I'm making a C++ back end for an application that'll heavily rely on AES-256 and DH. Should I trust third party libraries, or spend (lots of) time to learn about cryptographic implementation and write my own? Is there any reliable authority that can audit the security of a library (like Crypto++ in this case)? I hope this question doesn't come off as opinion based, but it's quite hard to find reputable data on this. I have no idea where to even start.

TL;DR: What's worse: risking vulnerabilities in a third party library, or risking novice mistakes in a custom implementation?

Explanation / Answer

Rather risk vulnerabilities of third party library than implement your own. If you feel novice on this field, only implement cryptography yourself as an learning exercise.

Why:

Mistakes, lack of know-how and maintenance.

It is very easy to make novice mistakes in custom implementation of cryptography. Even battle scarred veterans of the field do mistakes now and then. The amount of software quality assurance (including testing, reviews, ...) needed to ensure quality of cryptographic library is very significant.
When vulnerabilities are found third party cryptographic libraries are (often) updated. The user of the software may be able to update the library to newer version and (assuming API compatibility) fix the issue. If cryptographic functionality is built inside the program, all vulnerabilities always require fixes to the program itself.
Cryptographic libraries have to protect them against attacks almost no other software needs to (like timing attacks, and pretty recently, sound). New attacks are found now and then.
Even when no new attacks are not found, the cryptographic practices develop (towards safer). For instance, NIST considers 1024 bit RSA modulus fairly safe to use now, but in 1.1.2014, the minimum NIST accepts will be 2048 bit. Similarly, other parties "upgrade" minimum key length requirements from time to time.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.