4 ms·
I see no mention anywhere, on Graphite or Blockstack, about how the encryption actually works. I’ve checked the following resources: * The Blockstack whitepap
by dsacco 9y ago
I see no mention anywhere, on Graphite or Blockstack, about how the encryption actually works.
I’ve checked the following resources:
* The Blockstack whitepaper: https://blockstack.org/whitepaper.pdf https://blockstack.org/whitepaper.pdf
* Each of the System Design documents listed here: https://github.com/blockstack/blockstack-core/tree/master/docs https://github.com/blockstack/blockstack-core/tree/master/do...
* Blockstack General FAQ: https://blockstack.org/faq https://blockstack.org/faq
* Blockstack Technical FAQ: https://github.com/blockstack/blockstack-core/blob/master/docs/faq_technical.md https://github.com/blockstack/blockstack-core/blob/master/do...
* Blockstack Repository Readme: https://github.com/blockstack/blockstack-core https://github.com/blockstack/blockstack-core
* The Graphite FAQ: https://www.graphitedocs.com/faq https://www.graphitedocs.com/faq
* The Graphite Features: https://www.graphitedocs.com/features https://www.graphitedocs.com/features
This is a red flag. “Encryption” is far too unspecified. I’m looking for specific primitives, constructions, algorithms and design decisions. I want to know how key exchange happens, if a library like libsodium is used, whether you’re using AES-GCM or ChaCha-Poly1305, etc. I’m looking for an architecture diagram to understand which of these questions is coherent. Is key derivation used? Under which algorithm? I’m assuming your IDs are SHA-256 hashes, but is that correct? I don’t know.
Basically, aside from saying there are “ECDSA private keys” in passing, how precisely does encryption, key exchange and digital signing work? Maybe I missed a pretty obvious explanation in here - I was reading quickly (though pointedly). However, if that’s the case then mea culpa, and it should be easy to rectify by pointing out where exactly I missed this documentation.
For reference, here are examples of documentation I’m looking for[1]:
* Restic, under “Keys, Encryption and MAC”: https://restic.readthedocs.io/en/latest/100_references.html https://restic.readthedocs.io/en/latest/100_references.html
* Wireguard: https://www.wireguard.com/protocol https://www.wireguard.com/protocol
A basic overview of each primitive with a brief explanation of why it was chosen would go a long way here. I understand if Graphite is too young for this (though this should be a priority), but Blockstack should absolutely have something like this documented poignantly. If Blockstack does have this documented, Graphite should really link to it (poignantly).
________________
1. I have no affiliation with either of these, though I personally use them, and they’re not competitors anyway.
- ablankst 9y agoI'm on the engineering team at Blockstack, and wrote the client-side encryption functions used by applications. I totally agree with the idea that if software uses encryption, it should be documented, open-source, and ideally use a standard encryption protocol. Being able to say "this is exactly how encryption works" in a system is important, and I'm glad you're asking these questions. Encryption in Blockstack apps is performed client-side via library calls in blockstack.js (our javascript library). The encryption routines are implemented here [1], and implement ECIES, using the user's application-specific private key. That private key is passed to an application during the application authentication process [2]. All a blockstack application has to do is pass { "encrypt": true } in the storage routines, and this is invoked. We definitely would like to provide better documentation and messaging around how applications engage and use our client libraries -- and documenting our encryption routines is part of that. However, in the meantime, you can feel free to check out or codebase (it's all open source), and we'd always welcome any kind of feedback! [1] https://github.com/blockstack/blockstack.js/blob/master/src/encryption.js#L63 https://github.com/blockstack/blockstack.js/blob/master/src/... [2] https://github.com/blockstack/blockstack.js/blob/feature/auth-doc-improvements/src/auth/README.md#app-private-key https://github.com/blockstack/blockstack.js/blob/feature/aut...
- peterwwillis 9y agoNobody who's serious about security is going to use an app that does crypto in javascript. Why not make browser plugins to avoid this complication? Not to mention, if browser makers take their existing browser storage functionality and make more flexible interfaces for them, your app will be kind of useless, as the browser could sync user data with arbitrary cloud providers.
- rkangel 9y agoIs there a fundamental issue with crypto in JS (side-channel attacks?) or is it just that available crypto libraries in JS are immature?
- 9y ago