This attitude scares me. Some things really are hard to do. Some things really are hard to understand. Some are even both. Remember what Euclid is supposed to have said to Ptolemy I of Egypt when the king complained that geometry was hard to learn: There is no royal road to mathematics!
There's no shame in not being able to do or understand every difficult thing under the sun, but don't complain that such things "shouldn't be so hard". They often are. I think it's part of what makes life interesting.
Of course cryptography is hard, and it is an interesting topic (one I know a few things about as it turns out).
That's not even really a "security" concern, that's just good software engineering. Passing this function something that fails the prerequisites ought to be checked. (And yes, I'd check that it's prime, too. It's an expensive check once, but trivially memoized, and you can even prefill the memoization with the usual 65537 value to make it even cheaper. In this particular case, IIRC, the exponent is always or nearly always simply reused,)
Crypto is hard, and you shouldn't really be making these choices.
>> I shouldn't have to know about the chinese remainder theorem to use crypto properly.
Then stay out of it. Choose a library/framework that is popular, well tested and high level enough that you don't have to make these choices.
NaCl in particular provides simple Public/Private and Symmetric modes. The Authenticated Encryption Symmetric mode here is good - http://nacl.cr.yp.to/secretbox.html
Yes, and if you're going to use low level constructions he's right, and that will never change.
>> This is a valid complaint and "don't do it" isn't a valid solution.
Except that's not what I said, I said find a higher level library. When he asked I gave examples.
>> Too many "libraries" consist only of implementations of the crypto algorithms, but don't give any help with the proper use.
Then these may be the wrong libraries to use to secure your application. Great libs to poke around in the lower levels for a variety of other purposes of course.
On the flip side this should have set off warning bells for them - it can be a little bit of a code smell to pick 1 for a configurable value in your encryption. Not always a bad choice, but 1 has a lot of properties that can simplify various mathematical operations and Basically setting a crypto value to the smallest positive integer (and a non-prime at that!) is like deciding that a set of numbers in your code should always be represented by two-byte signed ints. Sometimes that's _exactly_ what you want (say, various fast math libraries), but if you're doing general purpose code you should really stop and think about whether you might end up with a value outside that.
I shouldn't have to know about gasoline to drive a car.
What's wrong with these statements?
The universe doesn't care that something "should" be easy.
A crypto library is the pilot. A crypto library that allows you to use insecure settings is a pilot who crashes the plane into a mountain because you asked him to.