5 ms·

Yes, so I googled "Curve25519 libsodium" and I still have absolutely no clue how to get this going. I mean the first hit starts with this sentence: "Ed25519 ke

Yes, so I googled "Curve25519 libsodium" and I still have absolutely no clue how to get this going. I mean the first hit starts with this sentence: "Ed25519 keys can be converted to X25519 keys, so that the same key pair can be used both for authenticated encryption (crypto_box) and for signatures (crypto_sign)." I have no idea what do to next.

janekm 7y ago
I think this would be a good starting point for what you are trying to achieve: https://libsodium.gitbook.io/doc/public-key_cryptography/authenticated_encryption https://libsodium.gitbook.io/doc/public-key_cryptography/aut... The first example shows both sides of the communication. The public keys are shared (but you want to make sure that you have the correct one, for example by meeting the recipient in person and comparing the keys). The library defaults in libsodium are already chosen to be secure (using Curve25519 and secure algorithms).
- skrebbel 7y ago
  That's really nice, thanks. I wonder how my Google fu failed me here. Bookmarking!
  - dylan604 7y ago
    Maybe it's not your Googlefu. Maybe it's because the article isn't a video on YouTube, or some sort of social media post, nor is the page heavily weighted with ad. It is a web page full of useful/on-topic information, and the current algo at Google seems to make those types of pages lower ranked. At least that's how it feels
JudgeWapner 7y ago
Then have another developer or consultant handle that part of your project. It seems like you misread a non-existent imperative in the article that "anyone can crypto with these 3 easy steps". They made no such claim.
- izacus 7y ago
  Where do those consultants/developers come from? Are they born from Crypto eggs with all the knowledge in their brain? Or how do those mighty people come to be?
  - lvh 7y ago
    There are good formal cryptography courses, though some of them focus on aspects that aren't relevant to what I'd call "cryptographic engineering". For example, differential cryptanalysis is very interesting, but basically nobody except the IOTA community is silly enough to try and implement their own primitives, so that's not a common problem. I authored Crypto 101. One of my cofounders co-authored Cryptopals and founded the cryptographic practice at Matasano (as well as co-founding Matasano itself ;)). So for cryptographic engineering, I think the answer is "historically oral, and increasingly written, tradition"?
CiPHPerCoder 7y ago
This might be a better starting point: https://paragonie.com/blog/2017/06/libsodium-quick-reference-quick-comparison-similar-functions-and-which-one-use https://paragonie.com/blog/2017/06/libsodium-quick-reference...
- skrebbel 7y ago
  Wow, your site is a goldmine! Really loving how you make this subject matter accessible for average nerds like me.
  - CiPHPerCoder 7y ago
    Thanks! I wish I were a little better at SEO so average nerds would have an easy time finding it.
    - skrebbel 7y ago
      I just read the article a second time and I really like it. This is precisely the starting point that I was craving for and if I had known about it I might not have written this rant :-) My only SEO advice is patience. Your articles are great, people will link to it increasingly often. That said, why the sole PHP focus? The starting point you just linked to is pretty much independent from PHP, and there's libsodium bindings in plenty languages. If your goal is simply to make good crypto easier to do for "normal" developers then the PHP association may do more harm than good (particularly because PHP is not very hip right now)
      - CiPHPerCoder 7y ago
        I'm mostly to blame for PHP adopting libsodium in version 7.2. Focusing on PHP was pretty on-brand at the time that was written. I'm going to need to update it (Argon2id is now the default), so I might generalize the code (or make a tab system to switch between examples).
- tzs 7y ago
  If I write something that uses libsodium, am I violating the near universal "don't roll your own crypto" admonishment, or does libsodium sufficiently hide all the scary dangerous cryptographic stuff so that mere mortals can safely use it?

janekm 7y ago

I think this would be a good starting point for what you are trying to achieve: https://libsodium.gitbook.io/doc/public-key_cryptography/authenticated_encryption https://libsodium.gitbook.io/doc/public-key_cryptography/aut... The first example shows both sides of the communication. The public keys are shared (but you want to make sure that you have the correct one, for example by meeting the recipient in person and comparing the keys). The library defaults in libsodium are already chosen to be secure (using Curve25519 and secure algorithms).

skrebbel 7y ago
That's really nice, thanks. I wonder how my Google fu failed me here. Bookmarking!
- dylan604 7y ago
  Maybe it's not your Googlefu. Maybe it's because the article isn't a video on YouTube, or some sort of social media post, nor is the page heavily weighted with ad. It is a web page full of useful/on-topic information, and the current algo at Google seems to make those types of pages lower ranked. At least that's how it feels

JudgeWapner 7y ago

Then have another developer or consultant handle that part of your project. It seems like you misread a non-existent imperative in the article that "anyone can crypto with these 3 easy steps". They made no such claim.

izacus 7y ago
Where do those consultants/developers come from? Are they born from Crypto eggs with all the knowledge in their brain? Or how do those mighty people come to be?
- lvh 7y ago
  There are good formal cryptography courses, though some of them focus on aspects that aren't relevant to what I'd call "cryptographic engineering". For example, differential cryptanalysis is very interesting, but basically nobody except the IOTA community is silly enough to try and implement their own primitives, so that's not a common problem. I authored Crypto 101. One of my cofounders co-authored Cryptopals and founded the cryptographic practice at Matasano (as well as co-founding Matasano itself ;)). So for cryptographic engineering, I think the answer is "historically oral, and increasingly written, tradition"?

CiPHPerCoder 7y ago

This might be a better starting point: https://paragonie.com/blog/2017/06/libsodium-quick-reference-quick-comparison-similar-functions-and-which-one-use https://paragonie.com/blog/2017/06/libsodium-quick-reference...

skrebbel 7y ago
Wow, your site is a goldmine! Really loving how you make this subject matter accessible for average nerds like me.
- CiPHPerCoder 7y ago
  Thanks! I wish I were a little better at SEO so average nerds would have an easy time finding it.
  - skrebbel 7y ago
    I just read the article a second time and I really like it. This is precisely the starting point that I was craving for and if I had known about it I might not have written this rant :-) My only SEO advice is patience. Your articles are great, people will link to it increasingly often. That said, why the sole PHP focus? The starting point you just linked to is pretty much independent from PHP, and there's libsodium bindings in plenty languages. If your goal is simply to make good crypto easier to do for "normal" developers then the PHP association may do more harm than good (particularly because PHP is not very hip right now)
    - CiPHPerCoder 7y ago
      I'm mostly to blame for PHP adopting libsodium in version 7.2. Focusing on PHP was pretty on-brand at the time that was written. I'm going to need to update it (Argon2id is now the default), so I might generalize the code (or make a tab system to switch between examples).
tzs 7y ago
If I write something that uses libsodium, am I violating the near universal "don't roll your own crypto" admonishment, or does libsodium sufficiently hide all the scary dangerous cryptographic stuff so that mere mortals can safely use it?