The longevity of Tarsnap is quite astonishing. Congrats to Colin Percival. --- Edit: Note to self: don't promote your home made crypto around famous people. (

The longevity of Tarsnap is quite astonishing. Congrats to Colin Percival. --- Edit: Note to self: don't promote your home made crypto around famous people. (I'm way past home made at this point, but since there is no way to tell from the outside…) Edit2: Seriously though, why? It can't just be because I veered off topic. --- Shameless plug: glad my own https://monocypher.org https://monocypher.org satisfies most of this, but we do have a couple departures: Encrypting data: Monocypher provides an XChacha20 + Poly1305 AEAD construction (copied straight from the RFC 7539). Why not XSalsa20? Because XChacha20 has a little bit more security margin, and is a little bit easier to optimise. Symmetric "signatures": Monocypher provides Blake2b, which provides a keyed mode for this. Blake2b doesn't need HMAC. Hashing Algorithm: Blake2b again, because it's faster and immune to length extensions attacks. I'm not sure why they still recommend SHA-2. Isn't Blake2 mature enough by now? Password Handling: Monocypher provides Argon2i. Close to the top of the list, but not quite. Asymmetric encryption: Monocypher doesn't have a box-like construction, but it does have a key exchange function, which combined with AEAD does the same thing as NaCl's crypto_box(). This makes the library more orthogonal, and I assumed combining key exchange and AEAD wasn't error prone. Asymmetric signatures: Monocypher defaults to EdDSA, with curve25519 and Blake2b. Why no SHA-512 instead? Because I already have Blake2b, which is faster, and I didn't want the bloat. (Ed25519 is provided as an option) I hope those departures are boring enough.