4 ms·

I would agree that OpenSSL is safer than using Go crypto. But I haven't seen any compelling evidence that it is any less secure than other non-Open SSL solution

• tptacek 14y ago
  That's because you're not looking for evidence. Just look at Langley's Twitter feed: Golang's SSL still has Lucky13 timing channels, and the RSA and elliptic/ECDSA code hasn't been assessed for side channels. I like Go, a lot, but I think you should hold off on recommending crypto libraries ("I wouldn't hesitate to use this library in production"); that's something you want to be sure about before you develop opinions.
  • voidlogic 14y ago
    To be clear I said I thought the Go crypo was suitable for some production uses. The text you put it quotes was not anything I ever said. I would rather use OpenSSL for a banking app for example. Since Go is >= version 1.0 and the crypo libraries in the standard library and not in go/exp, etc Go is implicitly endorsing them for some production use. I found closed issues that might be the ones you mentioned. If you are aware of issues, you should file them: http://code.google.com/p/go/issues/list?can=2&q=crypto&colspec=ID+Status+Stars+Priority+Owner+Reporter+Summary&cells=tiles http://code.google.com/p/go/issues/list?can=2&q=crypto&#...
    • wglb 14y ago
      The text you put it quotes was not anything I ever said Pretty close: He said "I wouldn't hesitate to use this library in production". You actually said "I would not hesitate to use the Go cypto in many production scenarios."