4 ms·
We should have the safe, just-connect version of Noise; my understanding is NoiseSocket wants to be that. I disagree with the comparison you made to JOSE et al
by lvh 8y ago
We should have the safe, just-connect version of Noise; my understanding is NoiseSocket wants to be that.
I disagree with the comparison you made to JOSE et al. The problem with those specs is the specification and implementation complexity of the product. But actual noise implementations like WG are counterexamples to this pathological mode: they have 1 mode with well-known properties. The real problem is that people think of Noise as a protocol spec and it’s really a roadmap for designing a protocol.
- tatersolid 8y agoThen Noise should say, in large font on the front page and in README: “Do not use this library or try to implement this spec without formal training in applied cryptography. Use X instead”. Make it very clear who the target audience is, or we’ll end up another generation of ad-hoc insecure crypto.