1
$\begingroup$

Based on my prior question about HMAC here Use of PBKDF2 when no access to HKDF? and the responses I received I decided to go ahead an implement HMAC based on the rvc5869 spec.

Is it appropriate to post that method and test code here for review and comments? If not, where do people recommend such code be posted for peer review and sharing with others? (the code is written in C#)

| | | | | |
$\endgroup$
  • 1
    $\begingroup$ Implementation questions usually are closed, because they are considered off-topic on this site. An overview about what is on-topic can be found here. Implementation questions in general are a better fit for StackOverflow, I don't think there is something with a specilization on crypto implementations. $\endgroup$ – tylo Feb 17 '17 at 16:25
  • $\begingroup$ @tylo thank you ,that basically answers this part of my question "where do people recommend such code be posted for peer review and sharing with others?" Can you post it as the answer? As an alternative I can just delete the question but it may help others. $\endgroup$ – Ron C Feb 17 '17 at 16:27
  • $\begingroup$ That said, a general question about implementation guidelines for writing cryptographic code may be appropriate. Asking for potential pitfalls, best practices, etc. $\endgroup$ – Stephen Touset Feb 17 '17 at 21:02
4
$\begingroup$

(originally a comment)

Implementation questions usually are closed, because they are considered off-topic on this site. An overview about what is on-topic can be found here.

Implementation questions in general are a better fit for StackOverflow, I don't think there is something with a specilization on crypto implementations.

| | | | | |
$\endgroup$
3
$\begingroup$

Posting code for general review is not appropriate here or on most Stack Exchange sites. It's too broad — Stack Exchange generally wants questions that can have a “definitive” answer.

There is however a Stack Exchange site which operates a little differently. You can post code for general review on Code Review. Do pay attention to their guidelines; in particular, the code must have no known bugs, i.e. you must post complete code that people can compile and it must be at least minimally tested.

If you're asking for very specific advice on some aspect of the code, such as performance or side channel resistance, then generally Stack Overflow is appropriate. Be sure to specify what you're concerned with, e.g. “my compiler doesn't put this variable in a register despite having free registers in this tight loop, how could I convince it?”.

Reviews for a very security-oriented aspect (e.g. side channel resistance) might get better feedback here than on SO. But here we generally frown on reading too much code, so focus on a small part (definitely don't post the full library in one go) an make sure your code is clear and well-commented.

| | | | | |
$\endgroup$

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .