alt Hacker NewsThe whole "There are test vectors so we know it's correct" is a strong sign that this isn't actually safe to use and that indeed the people who built it (to the extent people actually did build it) have no idea what they're doing.
Replies
To save you a read of the original while still having enough context, here's the whole section on crypto:
> crypto: spec and test-driven development to the rescue
> Cryptographic code is famously hard, with many, many footguns haunting unsuspecting developers (and even experts!).
> But, cryptography also has something that you likely won't find in any other domain: an extensive public collection of test vectors, particularly for edge cases. Every algorithm specification come with a basic suite of test vectors, but there are also community-built wonders such as Wycheproof.
> These test vectors, combined with the official specification documents of the crypto algorithms were rather effective to guide the coding agents and avoid the worst hallucinations.
> Cost: ~ $30
> Time: multiple days of part-time work.
> I'm under no illusion that the crypto crate is currently bug-free, but if my experience told me anything, it's that even experienced programmers are shipping bugs in crypto libraries. So, for similar outcomes, but using 1/100 of the time and at maybe 1/1000 of the cost, I think it's a clear demonstratin of AI's effectiveness.
Yeah, terrifyingly clueless, don't use.
For anyone wondering why, test vectors only cover “did the encryption work”. It does not cover “did you maintain constant time guarantees” to prevent against side channel attacks as an example. Crypto is filled with all kinds of such pitfalls that aren’t covered by conformance tests.
Hence “strong sign this is built by people who have no idea what they’re doing” is accurate.