5 ms·

App seems to be using this: https://libsodium.gitbook.io/doc/secret-key_cryptography/aead/chacha20-poly1305/ietf_chacha20-poly1305_construction https://libsodi

App seems to be using this: https://libsodium.gitbook.io/doc/secret-key_cryptography/aead/chacha20-poly1305/ietf_chacha20-poly1305_construction https://libsodium.gitbook.io/doc/secret-key_cryptography/aea... I have little experience with cryptography, and have no idea whether it is a good choice or not. If it is, how would you convince regular people that the state of the art “something something sodium chachacha” crypto algorithm in the app is the best for them? It might be better not to mention the name. Some stats would be nice, like: your files would take X years to decrypt if stolen (backed by some trusted sources).

_1tan 5y ago
libsodium is a solid choice.
tjohns 5y ago
> If it is, how would you convince regular people that the state of the art “something something sodium chachacha” crypto algorithm in the app is the best for them? Personally, I'd make a separate page with more details for the subset of folks who are interested. It doesn't need to be on the main page, but at least something to reassure technical users that the project hasn't rolled it's own DIY crypto would help. :) (And yes, libsodium is a great choice.)
GordonS 5y ago
You could have "state-of-the-art cryptography algorithm" as a link to a page with more details. Or just put the name of the algorithm in brackets afterwards, e.g. "state-of-the-art cryptography algorithm (ChaCha blah AES blah)".
- yvbbrjdr 5y ago
  I see. Should've been more concrete about this.
OJFord 5y ago
> App seems to be using this: https://libsodium.gitbook.io/doc/secret-key_cryptography/aea https://libsodium.gitbook.io/doc/secret-key_cryptography/aea... > I have little experience with cryptography, and have no idea whether it is a good choice or not. libsodium is from DJB & Tanja Lange, it doesn't get better/more trusted than that without preferring to trust some state entity of choice. (For some reason ranging from regulatory requirement to hopelessly misguided.) https://en.m.wikipedia.org/wiki/Daniel_J._Bernstein#Cryptography https://en.m.wikipedia.org/wiki/Daniel_J._Bernstein#Cryptogr... But yeah, average user doesn't care. It probably doesn't belong on the front page unless this intends only to target a security conscious audience.

_1tan 5y ago

libsodium is a solid choice.

tjohns 5y ago

> If it is, how would you convince regular people that the state of the art “something something sodium chachacha” crypto algorithm in the app is the best for them? Personally, I'd make a separate page with more details for the subset of folks who are interested. It doesn't need to be on the main page, but at least something to reassure technical users that the project hasn't rolled it's own DIY crypto would help. :) (And yes, libsodium is a great choice.)

GordonS 5y ago

You could have "state-of-the-art cryptography algorithm" as a link to a page with more details. Or just put the name of the algorithm in brackets afterwards, e.g. "state-of-the-art cryptography algorithm (ChaCha blah AES blah)".

yvbbrjdr 5y ago
I see. Should've been more concrete about this.

OJFord 5y ago

> App seems to be using this: https://libsodium.gitbook.io/doc/secret-key_cryptography/aea https://libsodium.gitbook.io/doc/secret-key_cryptography/aea... > I have little experience with cryptography, and have no idea whether it is a good choice or not. libsodium is from DJB & Tanja Lange, it doesn't get better/more trusted than that without preferring to trust some state entity of choice. (For some reason ranging from regulatory requirement to hopelessly misguided.) https://en.m.wikipedia.org/wiki/Daniel_J._Bernstein#Cryptography https://en.m.wikipedia.org/wiki/Daniel_J._Bernstein#Cryptogr... But yeah, average user doesn't care. It probably doesn't belong on the front page unless this intends only to target a security conscious audience.