3 ms·
> There's a subtext here of "what do I do when the high-level libraries like Sodium don't do exactly what I need", and the frank answer to that is: "well, you'r
by umvi 2y ago
> There's a subtext here of "what do I do when the high-level libraries like Sodium don't do exactly what I need", and the frank answer to that is: "well, you're in trouble, because consulting expertise for this work is extraordinarily expensive".
...which is exactly why people roll their own crypto. Security folks don't seem to realize/care that money is a real constraint at most companies (esp. startups) and security can easily become a money furnace. When the only two options are: "use sodium" and "extraordinarily expensive consultant" then devs turn to the third option: https://pkg.go.dev/crypto/aes https://pkg.go.dev/crypto/aes
Boom, file encrypted, requirement fulfilled, money saved, sale made. Perfectly secure? Probably not. The docs even say "The AES operations in this package are not implemented using constant-time algorithms". But maybe that's an acceptable tradeoff for your target risk profile.
- akerl_ 2y agoIf what you need is filed stored encrypted on disk... why is "use sodium" not a viable option for you?
- umvi 2y agoIt might be in many cases, but not every language it seems has explicit sodium support. Golang for example, has this not-widely-used wrapper (https://github.com/jamesruan/sodium https://github.com/jamesruan/sodium) maintained by some random guy which might not be desirable to use for a variety of reasons.
- loup-vaillant 2y agoForeign function interfaces aren't that scary. Any competent $lang developer ought to be able to read the docs and roll their own wrapper.
- Dylan16807 2y agoI bet more than 90% of the devs turning to a third option could in fact use sodium or an equivalent. Especially if the goal is "boom, file encrypted".
- umvi 2y ago> or an equivalent How does one identify the proper "equivalent" in a given programming language that doesn't have 1st class sodium support?
- Dylan16807 2y agoSecond class sodium is still a hell of a lot better than setting up your own. For go in particular, writing your own wrapper is a reasonable option. It's a handful of lines of code per function used. I don't have a full guide for identifying a proper equivalent, but "constant time" is a requirement.