4 ms·
With a purpose-built protocol called Golix [1]. The documentation goes into a lot more detail but it has three main aspects: 1. Encrypt things like PGP, except
by nbadg 10y ago
With a purpose-built protocol called Golix [1]. The documentation goes into a lot more detail but it has three main aspects:
1. Encrypt things like PGP, except key encapsulation is separate from ciphertext delivery. Specific primitives used are AES-256, RSA-4096, and X25519, though deprecation of RSA is planned soon
2. Everything is content/hash addressed, which helps substantially with the above. Specific primitive: SHA-512
3. Data retention is governed like a reference-counted programming language; data gets a container, and then you make a signed "binding" to give the container an address. You can then sign binding revocations ("debindings"). When no addresses are left, the server removes the content.
[1] https://github.com/Muterra/doc-golix https://github.com/Muterra/doc-golix
- pvg 10y agoOne thing I didn't get from the docs is some clearer explanation justifying what at first glance seems like a great deal of bespoke, custom crypto. Just browsing through the source I'm immediately hit with talk of running out of entropy, use of deprecated implementations, use of low-level functionality from a library that actually tries to provide safer, higher-level constructs, etc. Maybe this is all necessary. But it isn't at all obvious why.