5 ms·
Assuming you trust it (e.g. Google), Keyczar[1] is a good starting point. If you don't trust it and you can deal with the GPL, GPG[2] is probably a reasonable w
by SoftwareMaven 13y ago
Assuming you trust it (e.g. Google), Keyczar[1] is a good starting point. If you don't trust it and you can deal with the GPL, GPG[2] is probably a reasonable way to go, but key management is still a bitch.
Of course, these are very high level answers, and neither may actually work for you project, since you don't really talk about what making "security a core aspect" actually means.
Cryptography is insanely hard to get right. The more you can leave up to the peer-reviewed experts, the better.
1. http://www.keyczar.org/ http://www.keyczar.org/
2. http://www.gnupg.org/ http://www.gnupg.org/
- ericHosick 13y agoThanks. We'll check these out. We're creating a development environment based on a visual object language using a fully composable framework. The output of the development environment is blobs of "hooked up" objects. The user's programs are stored on host servers and, in real time, propagated to all people working on the project. Meta-data and data are also part of a program the user is creating. We would like to encrypt the blobs of objects so behavior can not be injected into the program (logic can be injected anywhere - think something like Aspect oriented programming to an extreme). We would like to encrypt any data (program - blobs of objects, meta-data and private user data) that is being persisted and/or propagated.
- stock_toaster 13y agoAlso check out http://nacl.cr.yp.to http://nacl.cr.yp.to there is a more library friendly version called sodium[1]. I don't know how much review has been done of that so far yet though.... [1]: http://labs.umbrella.com/2013/03/06/announcing-sodium-a-new-cryptographic-library/ http://labs.umbrella.com/2013/03/06/announcing-sodium-a-new-...
- ericHosick 13y agoSodium looks really interesting. Thank you.