4 ms·
Show HN: Saltshaker-Crypto, NPM to Sign, Verify, Encrypt and Decrypt with Nacl
- tptacek 8y agoHelp me understand. You've written a small Javascript wrapper around 'dchest's Javascript port of tweetnacl, and then added to it the ability to insecurely encrypt and decrypt with unauthenticated AES in CBC mode?
- jszymborski 8y agoIt is really strange that they added another library to do unauthenticated AES when nacl has a symmetric AEAD mode...
- stingraycharles 8y agoWasn’t use of CBC strongly discouraged because it allowed for padding oracles ?
- rasengan 8y agoHi tptacek, You're absolutely right. I'm revisiting the AES. Thaks for pointing it out. As for the rest, this is absolutely a wrapper around it -- working with tweetnacl.js directly could sometimes create a barrier of entry to developers. I wanted to make it easier for myself and others. There was already multiple references to dchest's tweetnacl, but I added more, because his library is awesome. Thanks for posting the article previously talking about nacl. ;) This was a reaction to that.
- jitl 8y agoSeems like the right library to post is https://github.com/dchest/tweetnacl-js https://github.com/dchest/tweetnacl-js which actually has been security audited