6 ms·
Meanwhile, XChaCha20 is still stuck at the stage of being a draft at the IETF with no apparent movement for close to two years now[0]. I'd like to see it be sta
by rdpintqogeogsaa 5y ago
Meanwhile, XChaCha20 is still stuck at the stage of being a draft at the IETF with no apparent movement for close to two years now[0]. I'd like to see it be standardized considering it's ubiquity that possibly dwarves that of pure ChaCha20.
[0] https://datatracker.ietf.org/doc/draft-irtf-cfrg-xchacha/ https://datatracker.ietf.org/doc/draft-irtf-cfrg-xchacha/
- tptacek 5y agoOn the other hand: who cares? IETF standards only matter if we let them matter. No cryptography engineer believes that XChaCha20 is problematic for lack of an RFC.
- R0b0t1 5y agoAh, but lots of middle manager types do.
- tptacek 5y agoIf middle managers are dictating your cryptography decisions, (1) you've got bigger problems and (2) you're using AES, not Chapoly.
- some_furry 5y agoCorrect: Middle managers almost universally care about NIST recommended algorithms.
- flatiron 5y ago"is it in tls 1.3? ok good, ship it"
- deleted 5y ago[deleted]
- rdpintqogeogsaa 5y agoIETF standards matter to IETF protocols, which will then choose from what the IETF has already standardized because trying to push your own RFC through is hard enough as-is; you don't really want to get into a kerfluffle with the CFRG at the same time.
- tptacek 5y agoTLS and JWT are both "IETF protocols", but the IETF police won't arrest if you if you slot XChaCha20 into either of them. This is actually how it's supposed to work: RFCs are meant, at least somewhat routinely, to trail implementations. "Loose consensus and working code" used to be the motto. Get XChaCha20 deployed, and then let the IETF standardize it because they have to. That's what happened with Curve25519.
- cesarb 5y agoThat might be the case when you already know a lot about cryptography. But when you're a newbie, an IETF standard which hasn't been marked as obsolete is a safe choice, in this case ChaCha20+Poly1305 (RFC 8439). Besides, if you don't have a standard document, there's the risk that your XChaCha20 is not the same someone else's XChaCha20, leading to interoperability issues.
- _wldu 5y agoPGP has RFCs (2440 and 4880) but people still complain about it. https://datatracker.ietf.org/doc/html/rfc4880 https://datatracker.ietf.org/doc/html/rfc4880
- tptacek 5y agoBecause nothing in the PGP RFCs matters; all that matters is what the most widely installed version of GnuPG accepts. This is part of what I'm talking about when I'm derisive of IETF cryptography standards, which are, generally, a force for evil.
- _wldu 5y agoThat makes me wonder if people are complaining about OpenPGP or instead about GnuPG? It probably doesn't really matter, but many newer encryption solutions ridicule PGP in general. Now I wonder if they mean to ridicule GnuPG instead?
- tptacek 5y agoIt's all the same thing. People talk about the standard as if it's an important thing by itself, but it has literally no meaning outside the installed base. You can't rehabilitate OpenPGP by observing that the standard allows you to implement it safely, because the installed base is what controls.
- tptacek 5y agoThe IETF is not providing as much safety for implementors as your comment implies that it does. Cryptography engineering is dangerous, even for standardized crypto (the implementation track record for IETF-standardized cryptography is not good).