3 ms·

PHP: First Programming Language to Add Modern Crypto into Its Standard Library

32 points by CiPHPerCoder 10y ago

jwilk 10y ago
> Invites developers to implement RSA-ECB Huh?
- CiPHPerCoder 10y ago
  The post linked above explains that in detail, but this is the exact section: https://paragonie.com/blog/2016/12/everything-you-know-about-public-key-encryption-in-php-is-wrong#rsa-ecb https://paragonie.com/blog/2016/12/everything-you-know-about... You mostly see this in amateur Java apps but badly written PHP that tries to use RSA makes the same mistake.
codehusker 10y ago
>Go 1.8 will use X25519 and ChaCha20-Poly1305 in its TLS stack, but it doesn't offer modern application-layer cryptography in its standard library. What qualifies as a standard library? I think Go supports both in the "x" repository which is officially part of the Go project, but is distributed separately and with different compatibility guarantees. It even gets vendored back into the main repository.
- CiPHPerCoder 10y ago
  1. Install the language. 2. Don't install anything optional. There, that's the standard library. Some ecosystems will never add something like NaCl/libsodium to the standard library because the main developer experience requires package management, but that's irrelevant to the very narrowly defined claim being made.
  - cptn_brittish 10y ago
    I know python keeps some packages outside the standard library as once it's in there development slows down and the package needs to be worked on more often. Did any discussion on this possibility come up as I can see cryptography requiring a quicker update cycle when bugs are found then a schedualed language release can give.
  - codehusker 10y ago
    Install the language how, and from where? What if my package manager includes libs like those under "x"? Or if it excludes certain libs? Homebrew is capable of this for many languages. What if my language includes different libs depending on install target, like targeting embedded environments? I think Rust does this. I think there is a large grey area being overlooked. EDIT: This is particularly true in PHP land. If I just install the meta php package in most distributions, I will get a different set of extensions included.
    - CiPHPerCoder 10y ago
      > Install the language how, and from where? Compile from src. Use the default options.
reustle 10y ago
Isn't PHP generally the first language to put anything in their standard library? I remember back when I did PHP dev, it seemed like all the batteries were always included.
rurban 10y ago
All very nice, but then calling this "SipHash-2-4 (fast hash for hash tables and similar data structures)" for the slowest hash function in existence is again the product of false marketing.

32 points by CiPHPerCoder 10y ago

jwilk 10y ago

> Invites developers to implement RSA-ECB Huh?

CiPHPerCoder 10y ago
The post linked above explains that in detail, but this is the exact section: https://paragonie.com/blog/2016/12/everything-you-know-about-public-key-encryption-in-php-is-wrong#rsa-ecb https://paragonie.com/blog/2016/12/everything-you-know-about... You mostly see this in amateur Java apps but badly written PHP that tries to use RSA makes the same mistake.

codehusker 10y ago

>Go 1.8 will use X25519 and ChaCha20-Poly1305 in its TLS stack, but it doesn't offer modern application-layer cryptography in its standard library. What qualifies as a standard library? I think Go supports both in the "x" repository which is officially part of the Go project, but is distributed separately and with different compatibility guarantees. It even gets vendored back into the main repository.

CiPHPerCoder 10y ago
1. Install the language. 2. Don't install anything optional. There, that's the standard library. Some ecosystems will never add something like NaCl/libsodium to the standard library because the main developer experience requires package management, but that's irrelevant to the very narrowly defined claim being made.
- cptn_brittish 10y ago
  I know python keeps some packages outside the standard library as once it's in there development slows down and the package needs to be worked on more often. Did any discussion on this possibility come up as I can see cryptography requiring a quicker update cycle when bugs are found then a schedualed language release can give.
- codehusker 10y ago
  Install the language how, and from where? What if my package manager includes libs like those under "x"? Or if it excludes certain libs? Homebrew is capable of this for many languages. What if my language includes different libs depending on install target, like targeting embedded environments? I think Rust does this. I think there is a large grey area being overlooked. EDIT: This is particularly true in PHP land. If I just install the meta php package in most distributions, I will get a different set of extensions included.
  - CiPHPerCoder 10y ago
    > Install the language how, and from where? Compile from src. Use the default options.

reustle 10y ago

Isn't PHP generally the first language to put anything in their standard library? I remember back when I did PHP dev, it seemed like all the batteries were always included.

rurban 10y ago

All very nice, but then calling this "SipHash-2-4 (fast hash for hash tables and similar data structures)" for the slowest hash function in existence is again the product of false marketing.