3 ms·
You are confused. They didn't invent a new cryptographic system, just implemented it. Just in the same way Internet Explorer didn't invent SSL, they just drop
by dsl 15y ago
You are confused. They didn't invent a new cryptographic system, just implemented it. Just in the same way Internet Explorer didn't invent SSL, they just dropped in a library.
The crypto under the hood is Curve25519. http://cr.yp.to/ecdh.html http://cr.yp.to/ecdh.html
I haven't looked at the source, but the most likely library for them to use (curve25519-donna) was written by the guy who does crypto for Chrome.
- peterwwillis 15y agoThanks for pointing this out, I didn't see NaCl and who it was written by; I thought maybe they wrote their own version of Curve25519. I'm still wary of the implementation until an expert looks over it, though.
- tptacek 15y agoJust so you know, there are very, very few experts competent to evaluate the DNSCurve cryptosystem. Since DNSCrypt relies on a proxy written in C, you'd want that reviewed, and can hope for a "looks clean" from the usual vulnerability research suspects. But you should understand that the people who submit Metasploit modules and the people who do real cryptosystem review are for the most part disjoint sets.
- peterwwillis 15y agoYes, this is part of why I reacted the way I did. I'm looking for an 'expert' to review it, not an average infosec nerd who groks C. I just wish my friends who did crypto knew how to program =(