Anastasiia Voitova — Use Cryptography; Don’t Learn It

Developers need to protect data, but should they need to become cryptographers to do it safely? Anastasiia Voitova, a software engineer working on data security at Cossack Labs, makes the case for boring cryptography: dependable libraries with clear, high-level interfaces and fewer opportunities for misuse. She explains the practical tension between encryption and application features such as searching, then walks through common mistakes in choosing algorithms, handling keys, and copying examples from the internet. Chris and Robert ask how developers can evaluate libraries and find trustworthy guidance. Anastasiia’s answer is to focus on the protection the application needs, choose tools designed for that job, and make the secure path easier than assembling cryptographic primitives by hand.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey provides application security education for developers and everyone in the software development lifecycle.→ Learn more about Security JourneyConnect with Anastasiia Voitova:→ Anastasiia Voitova at Cossack LabsMentioned in this episode:→ Cossack Labs→ OpenSSL→ GoFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Use cryptography without becoming a cryptographer01:43 Anastasiia’s route from development to data security04:36 The practical appeal of cryptography06:26 Data protection and searchable encryption10:34 What use cryptography, don’t learn it means12:07 Moving beyond don’t roll your own crypto14:02 Common mistakes in cryptographic design20:58 The risks of copying security examples21:46 Defining boring cryptography24:04 Choosing safer libraries and APIs28:22 Finding useful cryptography resources31:31 Practical advice for developers