6 ms·
This is a good point, most of Go's crypto library seems to be written in go: https://cs.opensource.google/go/go/+/master:src/crypto/crypto.go https://cs.opensou
by sackfield 3y ago
This is a good point, most of Go's crypto library seems to be written in go: https://cs.opensource.google/go/go/+/master:src/crypto/crypto.go https://cs.opensource.google/go/go/+/master:src/crypto/crypt...
Go can link to C but the process is a bit horrible. I wonder if Go's memory safety in comparison to C and the security implications reverses this a bit.
- ecnahc515 3y agoNone of that is an actual implementation of the cryptography, that's just the interfaces. The actual implementations are elsewhere and use architecture specific assembly for anything that needs constant time properties.
- FiloSottile 3y agoNo, we use assembly for access to specialized (e.g. AES-NI) or vector instructions, and we do so reluctantly. We much prefer writing cross-platform constant time Go. https://go.dev/wiki/AssemblyPolicy https://go.dev/wiki/AssemblyPolicy The actual implementations are in that tree, too: https://cs.opensource.google/go/go/+/master:src/crypto/ https://cs.opensource.google/go/go/+/master:src/crypto/