Crypto questions that can be migrated to crypto.stackexchange

Question

Since all new crypto questions are manually being migrated to the crypto stackexchange, why can't all the 400 existing crypto questions be migrated there? Currently its quite confusing to have some solved questions here and some over there.

Answer 1

Well, I'm a crypto mod and here's my take, bearing in mind I have an interest in promoting crypto:

Don't migrate old questions.

Really. There's no point in moving questions around just because right now they fit the scope of one site or another better. They were on topic here at the time, the OP has either had a resolution to their question or not checked back to see the outcome; either way, we're all done with those questions and unless there is a major reason to dig them up and improve them, we can leave them around for others to read at their leisure.

On a purely practical note, retagging 400 questions is not my idea of a fun weekend. Whilst I think the influx of questions would make crypto look good, it'd be a huge cleanup operation.

One of the things I took out of the recent firestorm on Stack Overflow r.e. closing and moving old questions was that actually we should judge a question on the answers it has - not purely on the question. The podcast for SE discusses this idea in unlimited amounts of detail.

The same applies to crypto vs security for a crypto question. It isn't about defining an ontology and moving crypto questions to crypto.se - it's about the answers you'll get:

• On Security.SE you're expecting a best-practices security-focused what-should-I-do-to-be-safe answer. If you ask about inventing your own crypto, you'll politely be told not to do that and instead directed to one of the many freely available crypto libraries, recommended reading, previous questions etc.
• If you ask on crypto, you'll get a detailed explanation of the various pitfalls of your scheme, with reference to relevant results.

Another practical problem of migrating all these questions is that many of them have answers in the former category, not the latter.

Finally, if there's a crypto question here on security that is harmful to the internet in its content, that can easily be fixed by existing mechanisms we have for that kind of thing - in increasing order of severity comments, downvotes, closing, deletion, whichever applies (the idea being we'd hopefully educate the poster along the way so that they fix the issue, whatever it is :)).

Answer 2

I dont think that any question tagged with crypto should automatically be migrated to the crypto site. Certainly not all the new crypto questions are being migrated, and there are definitely some existing ones that shouldnt be.

I see the difference as questions about crypto, how to use it, what to use, key management, what security trade-offs there are, etc - are more ontopic here than on crypto.se.
On the other hand, questions that are inside the cryptographic algorithms, internals, etc are the ones that should be migrated.

In other words, the theoretical, "math-y" parts of crypto should be there, the engineering parts here. (No, I'm not saying that all of crypto is "just" theoretical.)

While there is definitely some gray area, it seems that most questions are clearly either here or there.
I think the simple guideline is: If it's a question for a cryptographer / cryptologist / academician, it's a crypto.se question. If it's a question for a security engineer / architect / auditor / consultant, its a sec.se question.

Answer 3

I am a fan of "compendium of knowledge" and see value in moving high value/point questions to the appropriate site. I also see your point on how it can be confusing. There is overlap, and there isn't a hard and fast rule.

On the other hand, questions with false, misleading information should be closed on the appropriate site with a link to the most relevant answer on the correct site. This will prevent a site like Stackoverflow from overwhelming a smaller niche site such as cryptography. An uninformed reader may follow the advice of the highest voted question, and do things the wrong way. That is a loss for them and a loss for the SE community.

Finally, I think that questions with low votes, low views should be migrated according to user demand. Any time a question is touched (edits, rewrites, or especially mod flag) then they should be re-tagged accordingly. The retagging process is a pain, so perhaps the flagger should include new proposed tags as well.

This is my perspective so far:

• SO - for programming, language specific implementations
• Sec.SE - for all engineering, network, security admin and corporate policy questions
• Crypto - for issues dealing with crypto mechanics or implementation variances in various libraries/etc. Some Math questions here
• Math.SE - for deeper math questions that are more theoretical than Crypto's scope

Answer 4

In response to Avid's note, I'm compiling a list of questions that are probably better off in crypto.se. Please feel free to add/remove from this list.

• Does the hash change the security of the Secure Remote Password protocol?
• Where do I get prime numbers for Diffie-Hellman? Can I use them twice?
• Is this prime number large enough / too large for a Diffie-Hellman for AES-256?
• Which authentication at the end of the Secure Remote Password protocol?
• Optimal variable sizes in the Secure Remote Password protocol
• Implementing Secure Remote Password: Constructing the verifier
• Differing scrambling parameter generation methods in Secure Remote Protocol
• Using Secure Remote Password without sending the username in the clear
• Using Secure Remote Password without embedding the modulus
• How will security need to be changed if P=NP?
• Explain the naming with the variety of cipher-methods as seen by `$ openssl enc --help`
• Zero padding in HMAC
• HMAC key value and security