Thanks to a recent question, I realized that we have a tag, with 17 questions and the following tag wiki excerpt (quoted verbatim):

The Cyclic Redundant Check is non-cryptographic error-detecting code commonly used to detect accidental changes to raw data.

Given that even the tag wiki describes CRC as "non-cryptographic", the question arises whether any of these questions are really on-topic here, and (even if some of them are) whether we really should have a tag for something that seems to be explicitly off-topic here.

Now, granted, I can certainly imagine CRCs appearing as a part of a cryptosystem, or otherwise being tangentially mentioned in a valid, on-topic question. But, even though error-checking codes certainly are a pretty close topic to crypto, and even though some of the past CRC questions have received good answers here, I don't really see how a question primarily about CRCs could be on-topic here. Unless, of course, we just decide that they are — after all, the scope of the site is ultimately up to the community.

Given all that, I'd like to ask the community's opinion on the following issues:

  1. Should most of the questions currently tagged with be closed as off-topic (and what are the exceptions, if any)?

  2. If the answer to the previous question is "yes", what should we do with the tag itself? Should we remove it, to keep it from attracting further off-topic questions, or should we leave it in place and just add a warning that "questions primarily about CRCs may be off-topic here"? Or something else?

up vote 8 down vote accepted

CRC is a non-cryptographic checksum function, so it actually doesn't belong on Crypro.SE.

Our help center currently states:

Cryptography Stack Exchange is for asking questions about the mathematics and properties of cryptographic systems, their analysis ("cryptanalysis") and subsidiary topics that generally make up cryptology, such as random number generation. As such, we welcome questions on topics such as:

  • Asymmetric and symmetric cryptographic algorithms
  • Cryptographic protocols
  • Cryptanalysis techniques
  • Cryptographic hash functions, cryptographically secure hashing
  • Cryptography- and/or cryptanalysis-related Entropy and information theory
  • Cryptographically Secure (Pseudo-)Random Number Generation

I don't really see how CRC (being a non-cryptographic checksum function) would fit it there. Only when questions go (for example) "CRC vs SHA1", mentioning/handling CRC makes sense.

If we want to generally include all questions about error detection functions and other non-cryptographic types of checksums, we should reconsider our general theme (currently being cryptography) as well as several related help-center descriptions. Something tells me we don't want to go there... we're a site dedicated to cryptography and cryptanalysis; not a mixed-purpose Stack Overflow kind of site. If we were, we would most probably have been called "Algorithms.SE" or something alike. Yet, we're Crypto.SE - a clear name that says it all!

Last but not least, it should be noted that questions about CRC tend to find a nice home at Stack Overflow, just like checksums in general.

Edit: As the recent migration shows, people like Mark Adler tend to check such Q&As at SO - so, things like CRC definitely have a safe haven at Stack Overflow!

  • I managed to get into a rather heated discussion with Mark on SO. Heh, felt weird :) – Maarten Bodewes Jun 18 '16 at 11:48
  • 1
    I agree, and I'm pleased with the result of the migration in the Edit part of the answer. Definitely, anything about how to compute a CRC or its use for accidental error detection is off-topic. But I can think of a more precise description of the exceptions where CRC is on-topic: when CRC is part of a scheme with cryptographic intend. This includes use of CRC with a random poly in universal hashing, integrity attempted with ad-hoc combinations of CRC and encryption, and questions about the dangers of CRCs in adversarial context. – fgrieu Dec 1 '16 at 14:53
  • 1
    @fgrieu I'm totally with you. As soon as things involve crypto, it becomes on-topic here. I think it's somewhat like (for example) the fine line between "general LFSR questions" and "crypto- related LFSR questions" that tend to come up when people dive into stream ciphers et all. I'ld say that migration can make sense in some cases (like the Adler example shows), but that doesn't mean it always makes sense (because, in the end, SO is more about programming than crypto-knowledge). – e-sushi Dec 1 '16 at 15:26

I think it is pretty obvious that questions that are just about CRC are not on topic here. The problem is of course that it would not even be clear to me where they should belong. Definitely not on math, security or cryptography. StackOverflow maybe, but it isn't directly related to programming sometimes. Computer Science could be a good last option.

There are quite a few questions for the tag that are related to cryptography. E.g. when CRC is mixed with crypto or when CRC is used as a poor mans authentication tag then sure, by all means, please post here. And that's in my opinion a good reason to keep the tag as well. It would for such topics of course be a good idea to make sure that this kind of requirement is clearly documented within the tag description.

Some other questions should have been closed already, and I would invite the mods to take a good look at a few of them. Even if they don't do much harm in themselves they do lead to fingerpointing by authors of questions that become closed.

I present a counterexample to the proposition that the concept of CRCs is inherently non-cryptographic.

(This does not imply the cryptographic application is useful, of course! But who knows, maybe there are CRC circuits admitting arbitrary generator polynomials out of which one must implement a protocol on a tiny hardware device.)

  • I see your point, but I’m not really sure if the fact that things like “The standard way to make a MAC out of a CRC…” is worth adding a CRC tag. I’ld argue it would be more fitting to use the mac tag in that case, as that’s what you’re effectively creating there. From a CRC tag, I – as a user, not a mod – would expect Q&As about CRCs; like: how do I create them, how do I use them, and how they are used (in a pure, unmodified way) in cryptography. I don’t think that’s the message we want to send to users – as we’ld be bound to get CRC Qs which conflict what our help center says. – e-sushi Apr 17 at 12:04
  • Besides, the paper you link to in your counterexample itself draws a clear line between cyclic redundancy codes (CRC) used for non-cryptographic detection of information errors (which the CRC tag would hint at) and the proposed Cryptographic CRC (where design goals are very different from what ye average, non-cryptographic CRC offers). – e-sushi Apr 17 at 12:25
  • Oh, almost forgot. The “Do Rabin Fingerprints have any advantages over CRC?” Q&A would represent an equal counterexample (it even mentions the same paper you mentioned in your answer). – e-sushi Apr 17 at 12:25

It's part of a wider debate.

Some might argue that the design of TRNGs has nothing to do with cryptography either but they are often discussed here in great, lengthy detail. If you're willing to accept TRNGs , you'd have to accept CRC functions here too as they're often used as either the sole entropy extraction algorithm, or in combination with others. The TrueRNG uses Galois field mixing which is similar to CRCs. And NIST supports TrueRNG in their entropy measurement tool set so that must be pretty official given the thrall of NIST. IDQ Quantique uses similar matrix methods. OneRNG, NeuG and other more DIYey efforts use CRC16/32. But most importantly, the mathematics of entropy mean that CRC computation is a perfectly valid form of extraction, especially if you're not a NIST fanboi.

So if crypto.SE -> TRNG -> entropy -> extraction, I say leave it in.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .