2

I am planning to implement a cryptographic library for several languages and looking for best practices. I have looked at several threads, especially this, this, and this one, which answer my questions partly only. I am interested in a couple of languages (among others, C, Haskell, Python) and have read how to package software projects for each language. So here are my questions:

  • Do I create 1 repo for all languages or 1 repo for each language? In the former case, is there any "standard" folder structure?
  • Is it a good idea to implement the logic in a DSL like Cryptol, then translate to/generate code in the desired target languages? I.e., which is less effort: implementing the same logic for each (Turing-complete) language or once for a DSL, then a generator for each language?
  • Is it a good idea to implement the logic in one (Turing-complete) language, then call functions from all other languages? Or do I implement from scratch for each language?
  • Suggestions like this are welcome, but I'd like more info. Why do you recommend I learn and use Rust at the core (cryptography-specific advantages preferred)? – mushishi Jun 27 at 13:19
6

The best is to write the actual code in C or C++, and then to just create interfaces for any other languages so that for example a python developer can use the library in their python code without ever knowing the actual language.

Writing the implementation in multiple languages is a waste of time. It increases the number of bugs. With cryptography it is worse, since your cryptographic code might give the correct results, but might be vulnerable to timing attacks, for example. That’s bad enough in C, where you can know reasonably well what your code will exactly do. But would you have the slightest idea what attacks are possible against Java or Haskell code, when you have attackers that are not going to play by the rules?

Now since every language will need say the C language package, and you don’t want to duplicate it, and I don’t want to include two repositories, it is best to have everything in one repo.

| improve this answer | |
  • Marking this response as the answer since it answers all points. I interpret your first sentence as "DSLs provide no benefits" – mushishi Jun 27 at 13:16
  • If you want to support it, an alternative implementation language is rust. The important characteristics are the minimal runtime and ability to compile to a library with the C abi. – user1937198 Jun 27 at 15:39
  • I totally second this. C/C++ are so versatile and provide some interfacing to pretty much any major language that it is pretty much the best option. – Andy Jun 27 at 17:17
3
  • Is it a good idea to implement the logic in one (Turing-complete) language, then call functions from all other languages? Or do I implement from scratch for each language?

Generally yes. This is the usual way to do such thing. Implement all functions and algorithms in a language you choose for a core library only once (e.g. c or c++).

The interfacing with other programming languages is done via language bindings then (i.e. just calling the core library API functions, insteaad of reimplementing these in other languages).

The advantage is obviously, that potential changes or bug fixes need to be done in the core library once, and won't affect the other languages. And even if changes need to be done in the API, the impact for the other languages which bind to the API functions would be relatively small.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.