What does "don't build your own crypto" even mean any more?
I originally thought it meant "don't implement AES/RSA/etc algorithms yourself"
But now it seems to mean "pay auth0 for your sign in solution or else you'll definitely mess something up"
As an example, we have a signing server. Upload a binary blob, get a signed blob back. Some blobs were huge (multiple GB), so the "upload" step was taking forever for some people. I wrote a new signing server that just requires you to pass a hash digest to the server, and you get the signature block back which you can append to the blob. The end result is identical (i.e. if you signed the same blob with both services the result would indistinguishable). I used openssl for basically everything. Did I roll my own crypto? What should I have done instead?
I originally thought it meant "don't implement AES/RSA/etc algorithms yourself"
But now it seems to mean "pay auth0 for your sign in solution or else you'll definitely mess something up"
As an example, we have a signing server. Upload a binary blob, get a signed blob back. Some blobs were huge (multiple GB), so the "upload" step was taking forever for some people. I wrote a new signing server that just requires you to pass a hash digest to the server, and you get the signature block back which you can append to the blob. The end result is identical (i.e. if you signed the same blob with both services the result would indistinguishable). I used openssl for basically everything. Did I roll my own crypto? What should I have done instead?