3 ms·
> I'd not be inclined to use this in production anytime soon. Indeed you should not. Rolling crypto on your own is too damn dangerous, and that's what I just
by loup-vaillant 10y ago
> I'd not be inclined to use this in production anytime soon.
Indeed you should not. Rolling crypto on your own is too damn dangerous, and that's what I just did. On the other hand, I'm convince there's not much left to do to ensure a sufficient level of confidence, for 3 reasons:
1) The library is small. Almost as small as TweetNaCl itself.
2) With the exception of Poly1305 and curve25519, the primitives chosen here are simple and easy to test. If I didn't royally screw up somewhere (and I need external verification to make sure I didn't), those primitives are all production worthy.
3) curve25519 is is directly from TweetNaCl with very few modifications. The hard part (ensuring there are no rarely occurring limb overflow) has already been done there.
The weakest link for now is Poly1305: limb overflows are possible, and I did it from scratch. There's no way I can trust it without external review.