Cryptography with Paul Kehrer

Summary

Sooner or later you will need to encrypt or hash some data. Thankfully we have the Cryptography library, along with the other projects maintained by the Python Cryptographic Authority, to make sure that your crypto is done right. In this episode Paul Kehrer talks about how the PyCA got started, the projects that they maintain, and how you can start using cryptography in your programs today.

Brief Introduction

• Hello and welcome to Podcast.__init__, the podcast about Python and the people who make it great.
• I would like to thank everyone who has donated to the show. Your contributions help us make the show sustainable.
• When you’re ready to launch your next project you’ll need somewhere to deploy it. Check out Linode at linode.com/podcastinit and get a $20 credit to try out their fast and reliable Linux virtual servers for running your app or experimenting with something you hear about in this episode.
• Visit our site to subscribe to our show, sign up for our newsletter, read the show notes, and get in touch.
• To help other people find the show you can leave a review on iTunes, or Google Play Music, and tell your friends and co-workers
• Join our community! Visit discourse.pythonpodcast.com for your opportunity to find out about upcoming guests, suggest questions, and propose show ideas.
• Your host as usual is Tobias Macey and today I’m interviewing Paul Kehrer about cryptography and encryption in Python

Interview with Paul Kehrer

• Introductions
• How did you get introduced to Python?
• Can you share a bit of the background behind the Python Cryptographic Authority and how you got involved?
• There is an adage that you should never roll your own crypto because if there are bugs or exploits in your implementation then it can have potentially serious side effects. What problem was the Cryptography library created to solve that was important enough to proceed despite that risk?
• Given the sensitive nature of the libraries that you are working on, what development practices are you relying on to prevent the introduction of vulnerabilities?
• While reading through the documentation I noticed that Cryptography links against OpenSSL. Is it possible to swap that out for alternative implementations such as LibreSSL or S2N?
• What are some of the testing techniques that you use to ensure the accuracy of the algorithms that you are using?
• What are some of the factors that a developer should keep in mind when selecting which cryptographic library to use in their projects?
• When might someone want to use the capabilities found in the cryptography library what do they need to be aware of while writing their application?
• For someone who wants to incorporate the cryptography library into their project what are some of the potential pitfalls that they should be aware of and how much knowledge of encryption should they possess?
• In what ways does the security landscape in Python differ from that of other languages that you are familiar with and what unique challenges do we face?
• What are some of the fundamental aspects of encryption and cryptography that you feel every developer should at least be aware of?
• If anyone wants to learn more about security and encryption, what resources do you recommend?

Keep In Touch

• Twitter – @reaperhulk

Picks

• Tobias
  • Migadu
  • Castle Panic



• Paul
  • Frinkiac.com
  • Morbotron

Links

• S2N
• LibreSSL
• Cryptography 101
• General Number Field Sieve
• Lattice Based Crypto
• Google New Hope Cryptography
• Hypothesis
• Mersenne Twister
• CryptoPals Crypto Challenges

The intro and outro music is from Requiem for a Fish The Freak Fandango Orchestra / CC BY-SA