6 ms·

This is a good place to link to Orion [1], a pure-Rust crypto project for AEAD, stream ciphers, KDFs, MACs, and plain hashing. There hasn't yet been a formal se

This is a good place to link to Orion [1], a pure-Rust crypto project for AEAD, stream ciphers, KDFs, MACs, and plain hashing. There hasn't yet been a formal security audit (hard to justify until there's a significant user base), but the API is tough to beat for usability and hard-to-misuse-ability (docs [2]). It's an unproven library, but the author takes security pretty seriously. There's no unsafe, heavy testing, and fuzzing done for both safety (fuzzing with a sanitizer) and constant-time operation verification to minimize the danger of a timing attack. Here's an example of the API. let key = aead::SecretKey::default(); let ciphertext = aead::seal(&key, "msg".as_bytes())?; let plaintext = aead::open(&key, &ciphertext)?; It doesn't get much easier than that. Also, notice the lack of a user-facing nonce. Can't screw it up if it isn't there. There are also lots of details that are right in the library. Traits like PartialEq are implemented using constant-time operations so that users don't have to know or remember to use special operations provided by the library for comparison. Methods that return types without these protections (like getting the raw bytes out of a PasswordHash) are helpfully named things like "unprotected_as_encoded". [1] https://github.com/brycx/orion https://github.com/brycx/orion [2] https://docs.rs/orion/0.15.5/orion/aead/index.html#example https://docs.rs/orion/0.15.5/orion/aead/index.html#example

adkadskhj 6y ago
Orion looks cool, but i'm curious - where would one learn how to use a library like Orion? Eg, if Orion is aimed at easy to use - i'm still not the target audience. But, i do write software that i want to allow users to sign. To encrypt their data at rest. To verify signatures. Where would i learn what i need to use smart tools by other people? Where would i learn enough to decide how to choose solving my above problems with Orion vs GPG? That's been my biggest problem with crypto. I know enough to know to be wary, but not much beyond that. Choosing tools with that mindset is difficult. And so far, taking a crypto class is just teaching me fundamentals of building my own protocols - where as i just want to use existing tech, safely, and in the right situations.
- vlmutolo 6y ago
  That's a good question, and I'd be interested in hearing more about what parts of the library you're hung up on. The intention of the library is definitely to cater to people who don't know anything about crypto. My naive guess, without knowing exactly what the sticking point is for you, is that Orion could do a better job on the modules page [1] explaining exactly what each module is for and when to use it. Right now, I'd say the state of the library, rather than its intention, is that it's extremely usable for people who pretty much know what they want, and fairly hard for the average developer to misuse. But I believe the author would be very interested in something that makes the library cater better to people who don't want to learn crypto, but just want to get things done using it. [1] https://docs.rs/orion/0.15.5/orion/index.html#modules https://docs.rs/orion/0.15.5/orion/index.html#modules EDIT: After some thought, I think I would say that the API for Orion is maybe an 8/10 for beginners, but the documentation is still at maybe 5/10 or 6/10 for beginners. Someone who is familiar with crypto would probably be able to look at the documentation and know what they're doing, but for someone unfamiliar with crypto, I can see how there isn't a ton in the way of explanation of the various primitives. That would be a good area for improvement for the library.
  - adkadskhj 6y ago
    Sorry for the delay. Your guess is correct. I reach the modules page with a goal in mind, "I want to sign some data", "I want to generate a key pair to sign some data", etc - and am left questioning where to go next. Now, that sounds lazy, but it's more.. cautious - as i mentioned i am very wary of a potential footgun that would leave me using the wrong tool or the right tool in the wrong way. So without very, very explicit goal oriented documentation i'm left confused, unsure which module should be used to do what i seek. Crypto puts people who know the unknowns in an awkward position. If i was fully ignorant i'd probably find more progress, as i'd be willing to just throw bytes around and see what works. Yet i've seen so many horror stories and tales of caution that i'm left never knowing if it's safe to do X in Y scenario. Combine that with my goal of using this code in Desktop, Mobile, WASM (maybe web, definitely mobile, etc) - and a bunch of scary new attack vectors get introduced and compound confusion. It's difficult to know where to start haha. Anyway, hopefully this answers your question :)
netsec_burn 6y ago
I develop a Rust security application. As much as I want to use a pure Rust crypto library, the #1 factor for me is that it is audited. Unfortunately, libsodium (Sodium Oxide in Rust) and Rust-Crypto are the only ones that satisfies those requirements. libsodium being the only one that isn't easy to misuse. I wish I could help crowdfund a cryptographic analysis of all of the Rust crypto projects. It would certainly make cross compilation easier.
- vlmutolo 6y ago
  Yeah, that's why I tried to mention right up front that it isn't (yet) audited. I didn't want to give anyone the wrong impression. It's a bit of a chicken-and-egg problem, too, where it's hard to justify the expense of an audit if few people use the library, and it's hard to find people to use the library when it isn't audited. Here's the tracking issue for a first security audit: https://github.com/brycx/orion/issues/21 https://github.com/brycx/orion/issues/21. Near the bottom of that issue, an employee from NCC reached out and said that they may be interested in funding an audit for Orion, though it's been a couple months and that hasn't gone anywhere (that I know of).
  - brycx 6y ago
    > Near the bottom of that issue, an employee from NCC reached out and said that they may be interested in funding an audit for Orion Small correction: It was actually an employee of Mobilecoin, the company that funded the audits for RustCrypto, which were performed by NCC.
- dochtman 6y ago
  Are you not aware of the recentish audit of rustls and, by extension, parts of ring? https://jbp.io/2020/06/14/rustls-audit.html https://jbp.io/2020/06/14/rustls-audit.html (I also don't think all of RustCrypto has been audited, only very limited parts AIUI.)
  - roblabla 6y ago
    That's correct. aes-gcm (and by extension, aes and polyval) and chacha20poly1305 were audited. See https://www.reddit.com/r/rust/comments/fa8a96/audit_of_the_rustcrypto_aesgcm_and/ https://www.reddit.com/r/rust/comments/fa8a96/audit_of_the_r...

adkadskhj 6y ago

Orion looks cool, but i'm curious - where would one learn how to use a library like Orion? Eg, if Orion is aimed at easy to use - i'm still not the target audience. But, i do write software that i want to allow users to sign. To encrypt their data at rest. To verify signatures. Where would i learn what i need to use smart tools by other people? Where would i learn enough to decide how to choose solving my above problems with Orion vs GPG? That's been my biggest problem with crypto. I know enough to know to be wary, but not much beyond that. Choosing tools with that mindset is difficult. And so far, taking a crypto class is just teaching me fundamentals of building my own protocols - where as i just want to use existing tech, safely, and in the right situations.

vlmutolo 6y ago
That's a good question, and I'd be interested in hearing more about what parts of the library you're hung up on. The intention of the library is definitely to cater to people who don't know anything about crypto. My naive guess, without knowing exactly what the sticking point is for you, is that Orion could do a better job on the modules page [1] explaining exactly what each module is for and when to use it. Right now, I'd say the state of the library, rather than its intention, is that it's extremely usable for people who pretty much know what they want, and fairly hard for the average developer to misuse. But I believe the author would be very interested in something that makes the library cater better to people who don't want to learn crypto, but just want to get things done using it. [1] https://docs.rs/orion/0.15.5/orion/index.html#modules https://docs.rs/orion/0.15.5/orion/index.html#modules EDIT: After some thought, I think I would say that the API for Orion is maybe an 8/10 for beginners, but the documentation is still at maybe 5/10 or 6/10 for beginners. Someone who is familiar with crypto would probably be able to look at the documentation and know what they're doing, but for someone unfamiliar with crypto, I can see how there isn't a ton in the way of explanation of the various primitives. That would be a good area for improvement for the library.
- adkadskhj 6y ago
  Sorry for the delay. Your guess is correct. I reach the modules page with a goal in mind, "I want to sign some data", "I want to generate a key pair to sign some data", etc - and am left questioning where to go next. Now, that sounds lazy, but it's more.. cautious - as i mentioned i am very wary of a potential footgun that would leave me using the wrong tool or the right tool in the wrong way. So without very, very explicit goal oriented documentation i'm left confused, unsure which module should be used to do what i seek. Crypto puts people who know the unknowns in an awkward position. If i was fully ignorant i'd probably find more progress, as i'd be willing to just throw bytes around and see what works. Yet i've seen so many horror stories and tales of caution that i'm left never knowing if it's safe to do X in Y scenario. Combine that with my goal of using this code in Desktop, Mobile, WASM (maybe web, definitely mobile, etc) - and a bunch of scary new attack vectors get introduced and compound confusion. It's difficult to know where to start haha. Anyway, hopefully this answers your question :)

netsec_burn 6y ago

I develop a Rust security application. As much as I want to use a pure Rust crypto library, the #1 factor for me is that it is audited. Unfortunately, libsodium (Sodium Oxide in Rust) and Rust-Crypto are the only ones that satisfies those requirements. libsodium being the only one that isn't easy to misuse. I wish I could help crowdfund a cryptographic analysis of all of the Rust crypto projects. It would certainly make cross compilation easier.

vlmutolo 6y ago
Yeah, that's why I tried to mention right up front that it isn't (yet) audited. I didn't want to give anyone the wrong impression. It's a bit of a chicken-and-egg problem, too, where it's hard to justify the expense of an audit if few people use the library, and it's hard to find people to use the library when it isn't audited. Here's the tracking issue for a first security audit: https://github.com/brycx/orion/issues/21 https://github.com/brycx/orion/issues/21. Near the bottom of that issue, an employee from NCC reached out and said that they may be interested in funding an audit for Orion, though it's been a couple months and that hasn't gone anywhere (that I know of).
- brycx 6y ago
  > Near the bottom of that issue, an employee from NCC reached out and said that they may be interested in funding an audit for Orion Small correction: It was actually an employee of Mobilecoin, the company that funded the audits for RustCrypto, which were performed by NCC.
dochtman 6y ago
Are you not aware of the recentish audit of rustls and, by extension, parts of ring? https://jbp.io/2020/06/14/rustls-audit.html https://jbp.io/2020/06/14/rustls-audit.html (I also don't think all of RustCrypto has been audited, only very limited parts AIUI.)
- roblabla 6y ago
  That's correct. aes-gcm (and by extension, aes and polyval) and chacha20poly1305 were audited. See https://www.reddit.com/r/rust/comments/fa8a96/audit_of_the_rustcrypto_aesgcm_and/ https://www.reddit.com/r/rust/comments/fa8a96/audit_of_the_r...