On a regular base, we receive questions related to the usage and/or inner workings of cryptography-related software and/or libraries.
Seven randomly picked examples of many:
… Which Elliptic-Curve-based operation was made from the sender software?
… Is there any way to see (secret) key parameters (d, q and curve) of elliptic curve crypto algorithms in gpg2 exported secret subkeys? …
… While I'm sure a subjective and holistic reading of results is also helpful (especially for someone who knows a lot about RNGs and their tests), are there values that could be considered passing? …
Can someone explain to me what the ArgonHashString function in libsodium returns (i'm using the .net port). …
I am wondering if it is possible to use the public/private keys of two WireGuard peers also in another communication channel using libsodium? …
… crypto_scalarmult delegates to crypto_scalarmult_curve25519 declared (in libsodium) in crypto_scalarmult_curve25519.h but I can't seem to find the definition in a .c file anywhere (in the latest version on GitHub)? Is there a safe way to implement, or reuse an internal implementation, of point addition in libsodium?
Which algorithm is recommended to use when encoding / decoding JWT web application tokens? …
I’ve only picked seven random Q&As, but if you look around you’ll notice there is a whole range of them.
These kind of questions tend to border the “programming” on-hold reason:
Programming questions are off-topic even if you are writing or debugging cryptographic code. Unless your question is specifically about how the cryptographic algorithm, protocol or side-channel (mitigation) works, you should look into asking on Stack Overflow instead.
and if they don’t crash into that, such questions collide with our help center which states
If your question is about usage of a specific cryptographic software (not its cryptographic internals), Super User is the right site.
Fact is, answers often indeed tend to contain sourcecode or end up quoting part of the related software manual. Others explain how the software works, which commandline parameters to use, and/or how to interpret it’s output.
This makes me ask how we want to handle this. Currently, the line we draw seems to be pretty blurry. So, let’s discuss this to clarify things:
Are such questions indeed programming and/or software usage questions and should accordingly be put on hold (or locked for historical reasons) like it has been done on several occasions?
Or should we rethink our position related to questions about cryptographic software and libraries, and allow them? In that case we should probably adapt our help center texts and close-voting behaviour accordingly.