<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;"><font face="Courier New" size="2">Phillip Hallam-Baker <phill@hallambaker.com> writes:<br>
<br>
</font>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px"><font face="Courier New" size="2">>That is why I start teaching public key cryptography with digital signatures<br>
>rather than encryption.<br>
<br>
Depending on what your overall goal is, I would argue that teaching public-key<br>
cryptography at anything other than a very abstract level is detrimental<br>
rather than helpful. A year or two back I was doing some work with a company<br>
who had a pretty bright intern in who'd learned the theory behind RSA, DH, ECC<br>
(he had an enthusiastic teacher who was into all of these things), and was<br>
pretty good at all of that.<br>
<br>
This provided him with approximately zero help when he had to work with a SCEP<br>
client and X.509 certificates. Even if someone had asked him to write an RSA<br>
implementation from scratch (why would anyone ever do that?), since there<br>
wasn't time in the course to cover every nuance of every PKC algorithm (side-<br>
channels, formatting issues, use of entropy/nonces, etc etc) the result would<br>
have been an implementation that needed another five years of massaging and<br>
upgrading before it was ready for real-world use.<br>
<br>
So he would have been better served with a course that provided a fairly<br>
abstract overview of the principles of PKCs, and then a lot of exposure to how<br>
they're applied in the real world. He was a bright, enthusiastic kid so I<br>
just hope his first experience with real-world use of these systems didn't<br>
scare him away...<br>
<br>
Peter.<br>
</font><br>
</div>
</div>
</body>
</html>