FIFiloSottile·Feb 4, 2017
I was immediately concerned seeing a "Security" section that includes a "Public key encryption" chapter. And indeed, I was (not) disappointed.
The symmetric encryption section mentions only Blowfish (!? - not even in the stdlib) and DES (!! - not even 3DES), not AES. There is of course no mention of authentication, or AEADs. But it gets worse. The API presented is Cipher.Encrypt which is CATASTROPHIC. Cipher.Encrypt is a low-low-level API that only encrypts the first block worth of data, AND LEAVES THE REST UNENCRYPTED. It's meant to be used by CBC/CTR/GCM block mode implementations, of which there is no mention at all.
This is all it says about, you know, encrypting real data:
> The algorithms are block algorithms. That is they work on blocks of data. If your data is not aligned to the block size, then you will have to pad it with extra
Read the rest
blanks at the end.
This is the kind of advice which guarantees me a job forever. It's way worse than ECB.
The "Data integrity" section mentions MD4 (for which I can and did create a collision on my laptop in a few hundred lines of code) and recommends the broken MD5, converting the result into 4 uint32 for... some reason? It then calls HMAC a "variation" of a hash, while it's a completely different (and more useful) tool.
The public key chapter only mentions RSA, which is completely useless/dangerous on its own, and probably not what you should use in 2017, and offers a code snippet to generate a 512 bit key. 512. The stuff that academics break for fun.
The X.509 chapter makes a CA cert instead of a leaf.
The TLS section needlessly sets config.Rand and sets config.Time TO A FIXED VALUE, which off the top of my head might only break connections after a few minutes and not their security. Maybe. (And uses a funny "[0:]" with a needless 0, which I guess is a C-ism.)
> Security is a huge area in itself, and in this chapter we have barely touched on it. However, the major concepts have been covered.
The whole section should just have been a link to https://github.com/gtank/cryptopasta not to be harmful, but as it is, it is actively toxic.
I'm not saying anything about the quality of the rest of the book, but if you write a book on X where X != cryptography, please don't try to teach the user how to use cryptography. Or how to secure a gun.