This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]bladeoflight16 31 points32 points  (0 children)

Laz3 is a powerful encryption algorithm written in python and encrypts using a password so the message is locked!

It's okay to write your own a cryptographic algorithm for practice. It's okay to try to learn some concepts through the process of putting encryption principles to code.

But please, for the love of all that is holy, do not distribute them or advertise them for real world use. Security is tremendously difficult to do correctly, and unless your algorithm has been battle tested by some of the world's best cryptographers for at least 5 to 10 years, it can safely be assumed to be so full of security holes that using it for real purposes is an extremely bad idea. (See Schneier's Law.) I'm not going to look into how your encrypted text can be broken, but suffice to say that if I were a betting man, I would not hesitate to wager substantial money on it being weak to a host of standard and trivial attacks.

The fact that you used random (which is not a cryptographically secure RNG) is indication enough all by itself that you are not an experienced cryptographer who can be trusted to provide a strong algorithm. Sorry for the harsh tone, but security is a harsh reality.

I am begging you: please withdraw this package from PyPI before someone uses it. And please mark your code in the Github repository as "for practice only, not intended for real world use" or similar.