3 ms·
EnvKey[1] moved from OpenPGP (RSA) to NaCl[2] for its v2, which recently launched. It’s causing a difficult migration for our v1 users. Moving to a new encrypt
by danenania 5y ago
EnvKey[1] moved from OpenPGP (RSA) to NaCl[2] for its v2, which recently launched.
It’s causing a difficult migration for our v1 users. Moving to a new encryption scheme is not fun for a product with client-side end-to-end encryption.
But within a year or so of releasing the v1, it seemed like the writing was on the wall for OpenPGP and RSA. I didn't want to go down with a dying standard.
NaCl is so much better. In spite of the migration headaches that will likely cost us some users, I'm very happy I made this decision. It's so much faster, lighter, and more intuitive.
It’s legitimately fun to work with, which I never thought I’d say about an encryption library after cutting my teeth on OpenPGP.
1 - https://github.com/envkey/envkey https://github.com/envkey/envkey
2 - https://nacl.cr.yp.to https://nacl.cr.yp.to
- jossclimb 5y agoWhat was your reason for developing the project in typescript? Looks like an interesting choice for a CLI / key mgmt system.
- danenania 5y agoIt has a thick UI layer in React (which I wouldn’t want to write in anything else), and it’s crucial to be able to share types and functions across the whole stack, as it’s designed in a way where a lot is shared. That’s the main reason.
- marcus_cemes 5y agoI'm not familiar with NaCl, websites that don't seem to have been updated in 7 years (version states 2016?) make me a little suspicious about the future viability of said projects. Perhaps it's not something that needs to be updated very frequently, but my knee-jerk reaction is that it looks abandoned, especially considering that they have an "upcomming features" section. What made you choose it? Could PGP/GPG with ed25519 keys not have been sufficient? What makes NaCL "fun to work with"? For me, fun to work with would be Age [1] or Ring [2] with a elegant and well designed API. I'm also aware that the older something is, the more likely it has undergone peer review and security audits, unlike new Rust crypto libraries. [1]: https://github.com/FiloSottile/age https://github.com/FiloSottile/age [2]: https://github.com/briansmith/ring https://github.com/briansmith/ring
- zenexer 5y agoNaCl is a reference implementation by djb[1], but libsodium is more widely used[2] and offers the same API. [1]: https://en.wikipedia.org/wiki/NaCl_(software) https://en.wikipedia.org/wiki/NaCl_(software) [2]: https://doc.libsodium.org/libsodium_users https://doc.libsodium.org/libsodium_users