4 ms·
> Uses only modern cryptography, with formally verified implementations. That's a bit light on details. Does it have hardware acceleration? Replay attack prote
by Tepix 7y ago
> Uses only modern cryptography, with formally verified implementations.
That's a bit light on details. Does it have hardware acceleration? Replay attack protection? Perfect forward secrecy? What are the underlying algorithms? Implementation verified by whom?
> Small (~25 KB), with an equally small and readable code base. No external dependencies.
This looks cool, however I don't like the fact that it doesn't use a trusted crypto library such as libsodium. It is likely to get less review and if weaknesses are detected in the algorithms, it is less likely to be improved.
- sa1 7y ago> This looks cool, however I don't like the fact that it doesn't use a trusted crypto library such as libsodium. It is likely to get less review and if weaknesses are detected in the algorithms, it is less likely to be improved. That's somewhat amusing given that the author of dsvpn is the author of libsodium.
- forgotmypwd123 7y agoall the more reason for dsvpn to use libsodium!
- amq 7y ago> That's a bit light on details. Does it have hardware acceleration? Replay attack protection? Perfect forward secrecy? What are the underlying algorithms? Implementation verified by whom? More details here: https://github.com/jedisct1/charm https://github.com/jedisct1/charm
- gnode 7y agoThe Charm library appears to implement the Xoodoo cipher using SIMD instructions (SSE on x86; NEON on ARM). Implemented by the same author as the VPN. There appears to be a key exchange handshake to prevent replay attacks. PFS: doesn't look like it.
- jedisct1 7y agohttps://news.ycombinator.com/item?id=20493585 https://news.ycombinator.com/item?id=20493585
- armitron 7y agoKey rotation can in many cases be ultra annoying and you dismiss PFS far too easily. After Snowden, we know for a fact nation states are conducting massive data capture operations. In some cases, visiting specific trigger sites is enough to tag you. PFS is very useful and there is nothing wrong with admitting that DSVPN can be unsuitable for more people than just axe murderers.