Can I use my own implementation of a widely used, supposedly secure cryptographic algorithm for securing data at rest? I know you shouldn't roll your own crypto and generally its not a good idea to implement (and then deploy) any extensively tested and recommended algorithms by yourself either.
I have already seen this question, and as far as I understand, the main problem with implementing things yourself is that you will probably remain vulnerable to a host of side-channel attacks.
But suppose I have already implemented AES (just for fun and as a learning experience). What if I now use that implementation for simply encrypting files locally (and then perhaps back them up on the cloud or on removable media)? Since nobody other than me would be using the implementation, most of the side channel attacks would not apply. For instance, since no attacker can request an encryption/decryption (the way it works with a server), no timing attack can be carried out. Would this be as secure as using an extensively tested implementation?
In other words would using my own implementation of AES provide security for data at rest equivalent to the security provided by extensively tested implementations or will using it still be a stupid idea?
The big problem with RYO is the unknown unknowns. With popular implementations, there are fewer unknowns, more opportunities to find and fix flaws (more eyes on the code), and more guidance if something bad happens.
Think of it like an Ikea dresser; fine in the design studio, fine in the factory, fine in the store, deadly in a toddler's room. Without widespread dice-rolling, you might not find out about a flaw until it's too late and something bad happens to you alone. Also consider that the Maginot Line held as intended, yet still completely failed it's original purpose.
With a &quot;real&quot; AES, there's almost certainly targets juicer than your online backups to fall first, buying you time to fix vulnerabilities. There's no compelling reason stated that mitigates these risks or makes an important trade off, eg: lower battery usage than existing solutions. All i see is risk, no reward, and that makes it a no-brainer.
That said, if your implementation is interoperable with common tools, that suggests that your attack profile for at-rest data is likely similar to those common tools. That is, as long as you don't have mistakes or weaknesses, but that again is something of an unknown at this point; is the reward worth the risk?