3 ms·

The description claims it's "secure", but nothing pops up in the README when I Ctrl+F `audit`. So maybe take the "secure" claims with a grain of salt.

klabb3 2y ago
Meh. The author of age is very experienced and known specifically for security, crypto and within the implementation language (Go). Audits are only as good as the competence of the auditors and can often turn into checklist rituals. It certainly doesn’t hurt, but audits are not a panacea.
- quectophoton 2y ago
  Agreed, but IMHO claiming that a crypto library is secure without providing independent verification, is like claiming something is fast without providing benchmarks. (And both are the same in the sense that neither is a panacea.) I'm only bringing up audits because such claim was made, but maybe I should have said "independent verification" instead since it's more general.
  - klabb3 2y ago
    Sure, I think we agree in semantics but the wording is difficult. The bar for secure you’re referring to is quite high, a lot of commercial products that brand themselves secure would be much less secure than something like age. These days I think it’s fair to use “secure” in the sense of “made a serious effort to provide certain security properties”. It’s too hard to define, let alone agree, to what secure should mean for everyone.
  - tantalor 2y ago
    Sounds like a false analogy. "independent verification" is subjective. Who does the verification, do you trust them, how do you know they didn't screw up. "benchmarks" are objective. A is faster than B, we know because of the way that it is.
  - bpicolo 2y ago
    The library is out in the world. Audit at will. Have you seen Filippo's credentials? He's overwhelmingly qualified for this. https://github.com/FiloSottile https://github.com/FiloSottile > Today, I maintain the cryptography packages that ship as part of the Go standard library (crypto/… and golang.org/x/crypto/…), including the TLS, SSH, and low-level implementations, such as elliptic curves, RSA, and ciphers. These packages are critical to virtually every Go application, securing HTTPS requests, implementing authentication, and providing encryption.
    - quectophoton 2y ago
      I'm no cryptographer so I might be misunderstanding how all this works (also why I have to rely on whatever signal I can catch instead of just reviewing the code myself like with other more mundane dependencies), but it was my impression that in cryptography things were to be considered with skepticism until at least someone else (emphasis on "someone else") with good enough credentials/skills had attempted to break it at least once.
      - eximius 2y ago
        Because the vast majority of new works are not done by one of the few who would be qualified to check it. You can think of the cryptography community as similar to the math community. If some nobody makes a new proof of a big conjecture, it is considered with skepticism until some big name comes around to verify it. If Terence Tao comes out with a new proof in one of his specialities, people are going to assume it's basically correct or will have only very minor errors that are easily fixed.
        quectophoton 2y ago
        Makes sense, I see where I went wrong now, thanks for taking the time to explain.
- Ferret7446 2y ago
  What if the author has become malicious or is being blackmailed? N+1, N+2 is a common expectation in many fields (science replication, all manner of independent audits/investigations, nuclear launch codes, etc).
samatman 2y ago
The description claims these curves are "safe" but nothing pops up when I Ctrl+F `audit`. https://safecurves.cr.yp.to https://safecurves.cr.yp.to
- quectophoton 2y ago
  It's a good observation, but probably a bad example since that page is clear on what criteria they consider for something to be "safe". That aside, of course DJB would choose criteria that let him label his own curve as "safe". I'm no cryptographer so ultimately I have no choice but to rely on others' expertise, but that does not mean I take at face value the words of someone talking about their own project. Probably for the same reason HN requires disclosure when talking about something you're involved in.
tptacek 2y ago
This drives me a little nuts. There are something like 4 firms† in the world generally recognized as qualified for assessing cryptosystems, against dozens well-known and qualified to audit software but not cryptography. Cryptography is a rare specialty for software security people. How were you going to know whether an "audit" for age was meaningful? † and, to be fair, dozens of independent practitioners
- quectophoton 2y ago
  Oof, yeah maybe "audit" was the wrong word if it causes a reaction this strong. I just wanted to say it would be nice to know what makes this implementation secure other than the creator's own words about their own project. (EDIT: Though I guess you coming out to defend it is good enough signal to vouch in favor of it.)

klabb3 2y ago

Meh. The author of age is very experienced and known specifically for security, crypto and within the implementation language (Go). Audits are only as good as the competence of the auditors and can often turn into checklist rituals. It certainly doesn’t hurt, but audits are not a panacea.

quectophoton 2y ago
Agreed, but IMHO claiming that a crypto library is secure without providing independent verification, is like claiming something is fast without providing benchmarks. (And both are the same in the sense that neither is a panacea.) I'm only bringing up audits because such claim was made, but maybe I should have said "independent verification" instead since it's more general.
- klabb3 2y ago
  Sure, I think we agree in semantics but the wording is difficult. The bar for secure you’re referring to is quite high, a lot of commercial products that brand themselves secure would be much less secure than something like age. These days I think it’s fair to use “secure” in the sense of “made a serious effort to provide certain security properties”. It’s too hard to define, let alone agree, to what secure should mean for everyone.
- tantalor 2y ago
  Sounds like a false analogy. "independent verification" is subjective. Who does the verification, do you trust them, how do you know they didn't screw up. "benchmarks" are objective. A is faster than B, we know because of the way that it is.
- bpicolo 2y ago
  The library is out in the world. Audit at will. Have you seen Filippo's credentials? He's overwhelmingly qualified for this. https://github.com/FiloSottile https://github.com/FiloSottile > Today, I maintain the cryptography packages that ship as part of the Go standard library (crypto/… and golang.org/x/crypto/…), including the TLS, SSH, and low-level implementations, such as elliptic curves, RSA, and ciphers. These packages are critical to virtually every Go application, securing HTTPS requests, implementing authentication, and providing encryption.
  - quectophoton 2y ago
    I'm no cryptographer so I might be misunderstanding how all this works (also why I have to rely on whatever signal I can catch instead of just reviewing the code myself like with other more mundane dependencies), but it was my impression that in cryptography things were to be considered with skepticism until at least someone else (emphasis on "someone else") with good enough credentials/skills had attempted to break it at least once.
    - eximius 2y ago
      Because the vast majority of new works are not done by one of the few who would be qualified to check it. You can think of the cryptography community as similar to the math community. If some nobody makes a new proof of a big conjecture, it is considered with skepticism until some big name comes around to verify it. If Terence Tao comes out with a new proof in one of his specialities, people are going to assume it's basically correct or will have only very minor errors that are easily fixed.
      - quectophoton 2y ago
        Makes sense, I see where I went wrong now, thanks for taking the time to explain.
Ferret7446 2y ago
What if the author has become malicious or is being blackmailed? N+1, N+2 is a common expectation in many fields (science replication, all manner of independent audits/investigations, nuclear launch codes, etc).

samatman 2y ago

The description claims these curves are "safe" but nothing pops up when I Ctrl+F `audit`. https://safecurves.cr.yp.to https://safecurves.cr.yp.to

quectophoton 2y ago
It's a good observation, but probably a bad example since that page is clear on what criteria they consider for something to be "safe". That aside, of course DJB would choose criteria that let him label his own curve as "safe". I'm no cryptographer so ultimately I have no choice but to rely on others' expertise, but that does not mean I take at face value the words of someone talking about their own project. Probably for the same reason HN requires disclosure when talking about something you're involved in.

tptacek 2y ago

This drives me a little nuts. There are something like 4 firms† in the world generally recognized as qualified for assessing cryptosystems, against dozens well-known and qualified to audit software but not cryptography. Cryptography is a rare specialty for software security people. How were you going to know whether an "audit" for age was meaningful? † and, to be fair, dozens of independent practitioners

quectophoton 2y ago
Oof, yeah maybe "audit" was the wrong word if it causes a reaction this strong. I just wanted to say it would be nice to know what makes this implementation secure other than the creator's own words about their own project. (EDIT: Though I guess you coming out to defend it is good enough signal to vouch in favor of it.)