2 ms·

> Then Libsodium danced on the same line, and I was able to compare the results (they behave the same, phew). Do they really? What about timing attacks? Does a

> Then Libsodium danced on the same line, and I was able to compare the results (they behave the same, phew). Do they really? What about timing attacks? Does all your code run in constant time? If not, there's a whole class of vulnerability that basically will only be found when experienced attackers have a chance to poke at it. Timing attacks are a great example of why "don't roll your own crypto" is sound advice. No amount of testing your library against a reference library will uncover them.

loup-vaillant 9y ago
> Do they really? Absolutely: > […] However, XChaCha20 is currently not widely implemented outside the libsodium library, due to the absence of formal specification. https://download.libsodium.org/doc/advanced/xchacha20.html https://download.libsodium.org/doc/advanced/xchacha20.html Can't say for sure, but it look like they didn't have an independent implementation to compare to. Just like me a few months a go. --- > What about timing attacks? Monocypher is immune. First, the primitive were chosen precisely because they are easily immunised against timing attacks. Second, this is easily checked simply by looking at the source code: no secret-dependent branches, no secret-dependent indices, and that's about it. One doesn't need to be an expert to check that, a junior programmer could do it after being told what to look for.