3 ms·
> one-time-use combinations of three English words I really don't think that this is secure. > nacl/box and nacl/secretbox Both of which use XSalsa20 - which
by AnaniasAnanas 8y ago
> one-time-use combinations of three English words
I really don't think that this is secure.
> nacl/box and nacl/secretbox
Both of which use XSalsa20 - which while not broken there should be no reason to use it rather than (X)Chacha20.
- tptacek 8y agoYou're wrong. Magic Wormhole is fine, and so is XSalsa. XChacha is barely even a thing; Bernstein formalized extended-nonce Salsa20, but not Chacha20.
- tedunangst 8y agoXchacha is used in a corner of WireGuard, fwiw.
- bjoli 8y agoWireguard, libsodium, go's crypto libraries and Google's Tink have all implemented xchacha20-poly1305. I would not say that it's not a thing, but I would probably wait at least until the ietf process is over before using it.
- tptacek 8y agoI know it exists, and I don't think there's anything wrong with it. It's just weird to demand that everyone use it, since, as I said, it's barely a thing.
- AnaniasAnanas 8y agoUsing "one-time-use combinations of three English words" is "fine" only if your definition of "fine" includes allowing someone with a minimal budget to find out the password in less than a year. I am seriously wondering under what definition this could be considered better than OpenPGP. XSalsa20 is indeed fine, but XChaCha20 is better in every way. The proof for XSalsa20 provided by Bernstein applies to XChaCha20 as well.
- sdevlin 8y ago> Using "one-time-use combinations of three English words" is "fine" only if your definition of "fine" includes allowing someone with a minimal budget to find out the password in less than a year. Magic Wormhole uses a PAKE to establish a secure channel from a low-entropy shared secret.
- AnaniasAnanas 8y agoI admit that I missed that part. My mistake, I apologise.
- tptacek 8y agoYou might also acknowledge your faulty critique of systems that use XSalsa20.