Nubimus123: Hey, hey!

Pr0gram4tez: Ah, dear Nubimus. What inspires this chat window so close to happy hour on a Friday? Surely not a bug wreaking havoc on your users or offensive performance bottlenecks?

Nubimus123: No, Programates. Quite the opposite, in fact. I was interrupting your work to invite you for a beer to celebrate my team’s recent success. Surely you will join me.

Pr0gram4tez: Perhaps, my friend. First tell me about your success. I wish to learn from your work while my head is still clear. My week was full of disappointment and your youthful wisdom and inspiration may be necessary for solutions in the week that follows.

Nubimus123: Gladly, Programetes. The victory was one of cryptography. Our client’s data contains highly sensitive personal information and credit card numbers. They sought us out to secure their data that it never be consumed by either hacker or fool.

Pr0gram4tez: By Schneier! The protection of data of that nature is indeed important and critical to the order of the state.

Nubimus123: And that is why they rightly entrusted us with securing it.

Pr0gram4tez: Tell me, fellow developer, how did you achieve the security necessary to meet the requirements of your customer. Did you labor diligently designing an algorithm channelling all of your inventiveness? Did you employ all of your training and education designing a computation that was quick to perform while at the same time married to the highest standard of protection? Did you seek the cutting edge of mathematics and piety? My excitement implores an explanation!

Nubimus123: LOL!!!!!111 I must confess to you, who have always been honest with me. It all boils down to how we got the contract initially. Our bid was low because we allowed the gods to do the work for us. We used the cryto API in the framework crafted by the Olympians themselves.

Pr0gram4tez: How wonderful! It is said that mortals achieve their highest greatness when letting the gods handle the lofty computation so that they may focus their efforts on terrestrial business logic.

Nubimus123: Exactly.

Pr0gram4tez: Tell me, friend Nubimus, what class of divinely-crafted algorithms did you chose? Perhaps a symmetric-key cipher with Hermetic dispatch? Of either the stream or block subtype? Maybe even an asymmetric-key cipher with Alice and Bob unaware of each other’s cryptographic secrets?

Nubimus123: SMH… I believe you’ve failed to learn the very lesson you described mere sentences ago, Programates. Such details are of the divine and, while important, could only be made poorly by simple, mortal software developers. Though I believe the default algorithm for the framework was something called Athena’s Encryption Standard or AES. I’m lead to believe it’s the finest cryptographic work produced by god or man. I know not of style or tactics.

Pr0gram4tez: Interesting. The framework is so robust that the implementation required virtually no attention. You’ve not studied the algorithm itself?

Nubimus123: Like I said. That’s a matter for the gods.

Pr0gram4tez: We can agree that the code behind the cryptography is hallowed, but I’m not aware of methods that tailor the implementation to your business case as a matter of course in any framework. There must be much to the implementation, surely. Can you not harm your client if your implementation is incorrect? Could not the gods themselves attempt to injure your business interests?

Nubimus123: Assuredly not, Programetes. The framework’s code is not only holy but was developed in pairs and certified by a consortium of deities eliminating the possibility of any one Olympian’s mischief or mistake.

Pr0gram4tez: The first question remains unanswered, methinks. It is not possible for you to hinder the service with even the most well-intentioned practical application?

Nubimus123: Perhaps a layman. We are a professional team. We may not be gods, but I’m confident we consumed the framework as intended. Besides, the gods will assist us. We’ve prayed to them in social media. We’ve sacrificed to them with licensing fees.

Pr0gram4tez: The admission of the potential fallibility of an implementation using the framework troubles me, even if by a neophyte. I can accept the quality of the framework as it stands but you’ve only offered the credentials of your team as proof the implementation is correct. You say you’re professionals, but admit that you accepted the algorithm as a default without significant technical consideration. Did you investigate other algorithms offered by the framework? They’re equally divine and perhaps better suited to your toil.

Nubimus123: No, old friend. We have to deliver! Besides, the customer will be satisfied with reasonable security. What they’re really paying for is our work-flow and interface. There’s no way parameters to a cryptographic problem will significantly impact the effective security of our application in a negative way within the realm of practicality.

Pr0gram4tez: Whether implemented by either god or man are the cryptographic parameters not identically effective or ineffective? Speed and stability may be the domain of the gods, but would a small key size make you equally vulnerable regardless of the algorithm’s origin? Can you not impart your human fallibility on these holy tools?

Nubimus123: I must admit, Programetes, I’m unaware of the practical impact of key size in our implementation, but it’s certainly adjustable. It’s a problem easily solved with configuration. It’s still overwhelmingly in the hands of the gods who sold us the framework.

Pr0gram4tez: Very well, Nubimus. But keep in mind even with adequately-sized keys there are more cryptographic parameters such as the mode of operation. Even if adjustable at deploy-time are you aware of them now? Can you guarantee the data provided by your client will be ciphered optimally upon delivery so you don’t have to trouble them for migrations later?

Nubimus123: Another admission, oh thorough Promgrametes, follows. I have no answer as I’ve not studied modes of operation, but can note it for consideration with the team next week. Again, likely a matter of configration. You’ve proven the need for an audit so our configuration is correct upon delivery, but nothing has been stated yet indicating code needs changed or that our choice was flawed.

Pr0gram4tez: Please understand my goal is not to convince you to change your code, dear Nubimus! I’m simply trying to understand how productive the framework your team uses is. Perhaps I’ve turned up some points that require attention as is common for a grey-beard like myself. I do have some questions that are somewhat higher-level if you have time before we leave.

Nubimus123: My thirst grows, and my brain becomes weary on this Friday afternoon, but in exchange for the service you’ve provided I will certainly entertain them.

Pr0gram4tez: My gratitude is immense, Nubimus. Well then, the keys… Does the framework you employ provide a secure key storage facility?

Nubimus123: It does indeed, but we don’t use it. In effort to centralize our data we store the keys directly in the application’s relational store.

Pr0gram4tez: I’m puzzled, Nubimus. You store the ciphertext in the relational store, correct?

Nubimus123: That is true, Progametes.

Pr0gram4tez: And, as you’ve stated, the keys are in the relational store. All of them?

Nubimus123: Quite true.

Pr0gram4tez: So in the event of a compromise, beg the gods not, an adversary, perhaps an agent of Syracuse, would have all the tools necessary to recover the plaintext and use it against you or your clients or Athens itself?

Nubimus123: Well, I suppose so, Programetes. That seems unlikely, though. The attacker would have to compromise multiple, higher-level layers to achieve access.

Pr0gram4tez: What evidence do you have that any other layer of your application isn’t equally vulnerable? Have you not used the same strategy of trusting the framework above the judgement of mortal programmers? Is not the desired result of cryptography to protect your clients data in the event the higher levels of the application are compromised?

Nubimus123: Well, I fear that may be true, rare friend.

Pr0gram4tez: Tell me, then. Is the cryptography not potentially rendered irrelevant by your key storage practices. Is the net result that there is little security benefit but there is complexity incurred in the application?

Nubimus123: I admit that my understanding, and perhaps that of the whole team, of how to implement a cryptographic system was inadequate. We became emboldened by the code crafted by the gods and it made us feel invincible. I now know that a tool of the gods in the hands of man doesn’t make that same man godlike.

Pr0gram4tez: I regret that our conversation may leave you with your mood diminished, Nubimus. I am sorry for that. It was not my intention to play your adversary, but I am thankful that you and your clients may benefit.

Nubimus123: And I thank you for it, teacher Programetes. Regardless, my eyes can focus on pixels no longer. It’s time to close this chat window.

Pr0gram4tez: Beer, then?

Nubimus123: I’ve changed my mind, Programetes. I feel I must stay sharp for a busy weekend of study.