Is "how good is this encryption" in the scope of code review

Question

I recently asked a question on Cryptography, that involved an encryption that I wrote. Usually, asking simply "how good is this encryption" would be out of the scope for that site.

my question: being as this site is for reviewing code, would a "how crackable is this encryption" be in the scope of this site?

Answer 1

No, it would not. Security is on topic, but an encryption algorithm is not code. You may explain it with code, but it is really an algorithm. My opinion is that algorithms are a high level design topic and are off topic.

Answer 2

I would have to agree with Michael K. A simple way to tell if your post is on-topic is to go through this checklist.

1. Does my question contain code? (Please include the code in the question, not a link to it)
2. Did I write that code?
3. Is actual code from a project rather then pseudo-code or example code?
4. To the best of your knowledge, does the code work?
5. Do you want feedback about any or all facets of the code?

While your post did contain code, it is just example code that demonstrates how the algorithm work.

Answer 3

The scope of such a review would necessarily be limited to the correctness of the implementation rather than the strength of the algorithm.

However, as well as the usual Code Review items (such as readability, program structure, speed/memory performance, error handling and the rest), there are opportunities to consider some additional aspects of the implementation:

• weakness to timing attacks
• management of memory containing sensitive data (such as keys or plaintext)

I would not expect a reviewer to consider the cryptographic strength of the algorithm. And if I were requesting such a review, I don't think I'd want to set great store in assurances given by strangers from the Internet...