3 ms·
The idea is nice but the crypto has some gaps.
by mentat 11y ago
The idea is nice but the crypto has some gaps.
- lenish 11y agoFor anyone else wondering, they're using AES-CBC with no MAC: https://github.com/meshbird/meshbird/blob/master/secure/crypt.go https://github.com/meshbird/meshbird/blob/master/secure/cryp... Should at least use a decent HMAC construction, but would be better to switch to AES-GCM. There's an issue filed for it: https://github.com/meshbird/meshbird/issues/4 https://github.com/meshbird/meshbird/issues/4
- miolini 11y agoYeah, AES-GCM is better choice for our Meshbird. I've posted AES benchmarks in GO into golang-dev mailgroup. https://groups.google.com/forum/#!searchin/golang-dev/aes/golang-dev/bp8M7aUrw-0/RoZG9_3oCAAJ https://groups.google.com/forum/#!searchin/golang-dev/aes/go...