3 ms·
Considering NaCl in the context of papers like http://eprint.iacr.org/2010/594 http://eprint.iacr.org/2010/594 (timing the CPU cache to break AES) is... interes
by JoachimSchipper 16y ago
Considering NaCl in the context of papers like http://eprint.iacr.org/2010/594 http://eprint.iacr.org/2010/594 (timing the CPU cache to break AES) is... interesting. You'd hope that Google would have considered such issues, but a quick search doesn't yield anything.
- chc 16y agoAre you saying that AES in JavaScript is more secure?
- JoachimSchipper 16y agoIn the sense that Javascript crypto is horribly broken (see e.g. http://rdist.root.org/2010/11/29/final-post-on-javascript-crypto/ http://rdist.root.org/2010/11/29/final-post-on-javascript-cr...) but can't really be used to attack other applications running on your computer, yes. NaCl itself is probably fine-ish for implementing crypto protocols - it's just that it looks like a perfect vehicle for attacking other crypto implementations running on the same processor. (Well, except for the noise from running Chrome, but I still wouldn't use an SSH session while running NaCl.)