On a regular base, we receive questions related to the usage and/or inner workings of cryptography-related software and/or libraries.
Seven randomly picked examples of many:
… Which Elliptic-Curve-based operation was made from the sender software?
pgpdump alternative for gnupg 2.x
… Is there any way to see (secret) key parameters (d, q and curve) of elliptic curve crypto algorithms in gpg2 exported secret subkeys? …
What values constitute failing for ENT tests?
… While I'm sure a subjective and holistic reading of results is also helpful (especially for someone who knows a lot about RNGs and their tests), are there values that could be considered passing? …
libsodium (ArgonHashString function)?
Can someone explain to me what the ArgonHashString function in libsodium returns (i'm using the .net port). …
Is the following crypto compatible so that I can use the same keys for both products (Wireguard & Libsodium)?
I am wondering if it is possible to use the public/private keys of two WireGuard peers also in another communication channel using libsodium? …
Point addition in NaCl/libsodium (Curve25519)
… crypto_scalarmult delegates to crypto_scalarmult_curve25519 declared (in libsodium) in crypto_scalarmult_curve25519.h but I can't seem to find the definition in a .c file anywhere (in the latest version on GitHub)? Is there a safe way to implement, or reuse an internal implementation, of point addition in libsodium?
HMAC-SHA256 vs HMAC-SHA512 for JWT API authentication
Which algorithm is recommended to use when encoding / decoding JWT web application tokens? …
I’ve only picked seven random Q&As, but if you look around you’ll notice there is a whole range of them.
These kind of questions tend to border the “programming” on-hold reason:
Programming questions are off-topic even if you are writing or debugging cryptographic code. Unless your question is specifically about how the cryptographic algorithm, protocol or side-channel (mitigation) works, you should look into asking on Stack Overflow instead.
and if they don’t crash into that, such questions collide with our help center which states
If your question is about usage of a specific cryptographic software (not its cryptographic internals), Super User is the right site.
Fact is, answers often indeed tend to contain sourcecode or end up quoting part of the related software manual. Others explain how the software works, which commandline parameters to use, and/or how to interpret it’s output.
This makes me ask how we want to handle this. Currently, the line we draw seems to be pretty blurry. So, let’s discuss this to clarify things:
Are such questions indeed programming and/or software usage questions and should accordingly be put on hold (or locked for historical reasons) like it has been done on several occasions?
Or should we rethink our position related to questions about cryptographic software and libraries, and allow them? In that case we should probably adapt our help center texts and close-voting behaviour accordingly.
java.lang.IllegalStateException). In the end, it’s SO material because the problem lies in Java code, not cryptography. Besides that, note that SO has an encryption tag for a reason. $\endgroup$