4 ms·
In the CIO summary they mention every service uses KeyCZAR. First line on KeyCZAR repo: "Important note: KeyCzar has some known security issues which may infl
by AJRF 10y ago
In the CIO summary they mention every service uses KeyCZAR.
First line on KeyCZAR repo:
"Important note: KeyCzar has some known security issues which may influence your decision to use it."
https://github.com/google/keyczar#known-security-issues https://github.com/google/keyczar#known-security-issues
- jcims 10y agoThey could be design decisions that are tailored for Google's use or issues for which Google has other compensating controls.
- apeace 10y agoThe first listed issue is "Use of SHA 1 and 1024 bit DSA", which they admit are "considered weak by current security standards". Not sure why the OP has been downvoted. Definitely something interesting to note.
- noja 10y agoLike "Use of SHA 1 and 1024 bit DSA". Ouch.
- nealmueller 10y agoI work at Google. The final bullet in the CIO Summary on Keyczar was a typographical error, taken from our paper on encryption at rest (https://goo.gl/hSordh https://goo.gl/hSordh). It's since been removed from this Security Design Overview. The encryption at rest paper goes into additional detail and includes the important clarification that while a very old version of Keyczar was open-sourced, the open-sourced version has not been updated to reflect internal developments.
- AJRF 10y agoThanks for the reply and follow on information. Wondering why those internal changes didnt get rolled into the public release, especially if they were security focused updates? Lack of adoption of the library maybe?
- sweis 10y agoKeyczar is no longer being maintained and should probably be deprecated. Either that or someone can take the reins and update it to use modern algorithms.