Anastasiia Voitova — Use Cryptography; Don’t Learn It

Developers need to protect data, but should they need to become cryptographers to do it safely? Anastasiia Voitova, a software engineer working on data security at Cossack Labs, makes the case for boring cryptography: dependable libraries with clear, high-level interfaces and fewer opportunities for misuse. She explains the practical tension between encryption and application features such as searching, then walks through common mistakes in choosing algorithms, handling keys, and copying examples from the internet. Chris and Robert ask how developers can evaluate libraries and find trustworthy guidance. Anastasiia’s answer is to focus on the protection the application needs, choose tools designed for that job, and make the secure path easier than assembling cryptographic primitives by hand.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Anastasiia Voitova:
→ Anastasiia Voitova at Cossack Labs

Mentioned in this episode:
→ Cossack Labs
→ OpenSSL
→ Go

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Use cryptography without becoming a cryptographer
01:43 Anastasiia’s route from development to data security
04:36 The practical appeal of cryptography
06:26 Data protection and searchable encryption
10:34 What use cryptography, don’t learn it means
12:07 Moving beyond don’t roll your own crypto
14:02 Common mistakes in cryptographic design
20:58 The risks of copying security examples
21:46 Defining boring cryptography
24:04 Choosing safer libraries and APIs
28:22 Finding useful cryptography resources
31:31 Practical advice for developers