11 ms·

What about NACL? It seems more flexible that PGP but still provides a fairly high level of abstraction. Not sure what is a good library for doing PBKDF2 or simi

• tptacek 13y ago
  I like Nacl. I also like Keyczar. I would be very worried about a project that oscillated from PGP to Nacl to Keyczar, though.
• drostie 13y ago
  Probably the best KDF you'll get right now is scrypt[1]. NaCl did not see common adoption because until a relatively recent distribution called Sodium[2], it was not portable. And I mean really, not portable. Like, just to give an example, suppose you want to use NaCl in Node.js, which is pretty good about accepting C/C++ modules. You have two options today: one doesn't work on a 64-bit system[3] and one isn't C, it's JS which was transpiled with Emscripten[4]. I mean, don't get me wrong: the fact that we can now do this in pure JS via Emscripten is amazing, but yeah, NaCl was not universally buildable and therefore was not reliably deployable, and nobody really wanted to fix it until Sodium came along. [1] https://www.tarsnap.com/scrypt.html https://www.tarsnap.com/scrypt.html [2] https://github.com/jedisct1/libsodium https://github.com/jedisct1/libsodium [3] https://github.com/thejh/node-nacl https://github.com/thejh/node-nacl [4] https://github.com/tonyg/js-nacl https://github.com/tonyg/js-nacl
  • tptacek 13y ago
    scrypt is great if you want to store passwords, but not really helpful in other contexts. Nacl is a complete cryptosystem; think of it as a stronger, more modern, library-ized version of GPG. Don't use a JS translation of Nacl. Nacl goes to pains to ensure that it doesn't expose side channels; no Javascript implementation can make the claims Nacl makes.
    • jiggy2011 13y ago
      Couldn't you use the output of scrypt as a key for a symmetric cipher?
      • tptacek 13y ago
        You could if you were going to design your own cryptosystem, but not doing that is the point of this subthread.
        • kragen 13y ago
          Nacl still leaves you with the necessity to manage your keys, whether you're deriving them from passphrases (in which case you should use a KDF, and scrypt should work) or storing them.
          • tptacek 13y ago
            Ok, that's true; if you use the secretbox APIs and aren't using randomized keys, you'd want something like scrypt. You're right.
            • kragen 13y ago
              Even if you're using the non-secretbox APIs like crypto_box.
        • tel 13y ago
          At what point aren't you designing your own cryptosystem? Even if you use NaCl you must store your keys, determine when and when not to encrypt, decide how to generate nonces, pick between symmetric and asymmetric ciphers. I understand strongly that you should work with as large a black box as you can afford, but it becomes increasingly grey as you move toward operational stuff over "obvious" crypto stuff.
      • keeperofdakeys 13y ago
        Scrypt is a Key Derivation Function, as well as a password hash, so it has a few uses. If you want to take many parameters, and make a random key, it will work well. If you want to record a secret value (ie. password database), it works incredibly well. If you want to use it on a password for something like AES-CBC, then you probably don't need it, since AES-CBC is already secure. Most encryption algorithms are already designed to take a users key, and apply them in a secure fashion. Unless you aren't using such an algorithm, you should trust the crypto primitives that have already been built for you. Of course, many people will have special use cases, but they should already know what they are.