3 ms·
That might be the case when you already know a lot about cryptography. But when you're a newbie, an IETF standard which hasn't been marked as obsolete is a safe
by cesarb 5y ago
That might be the case when you already know a lot about cryptography. But when you're a newbie, an IETF standard which hasn't been marked as obsolete is a safe choice, in this case ChaCha20+Poly1305 (RFC 8439). Besides, if you don't have a standard document, there's the risk that your XChaCha20 is not the same someone else's XChaCha20, leading to interoperability issues.
- _wldu 5y agoPGP has RFCs (2440 and 4880) but people still complain about it. https://datatracker.ietf.org/doc/html/rfc4880 https://datatracker.ietf.org/doc/html/rfc4880
- tptacek 5y agoBecause nothing in the PGP RFCs matters; all that matters is what the most widely installed version of GnuPG accepts. This is part of what I'm talking about when I'm derisive of IETF cryptography standards, which are, generally, a force for evil.
- _wldu 5y agoThat makes me wonder if people are complaining about OpenPGP or instead about GnuPG? It probably doesn't really matter, but many newer encryption solutions ridicule PGP in general. Now I wonder if they mean to ridicule GnuPG instead?
- tptacek 5y agoIt's all the same thing. People talk about the standard as if it's an important thing by itself, but it has literally no meaning outside the installed base. You can't rehabilitate OpenPGP by observing that the standard allows you to implement it safely, because the installed base is what controls.
- tptacek 5y agoThe IETF is not providing as much safety for implementors as your comment implies that it does. Cryptography engineering is dangerous, even for standardized crypto (the implementation track record for IETF-standardized cryptography is not good).