5 ms·

Like NaCl? http://nacl.cr.yp.to/ http://nacl.cr.yp.to/

• tptacek 13y ago
  NaCl addresses a different problem than OpenSSL. NaCl is great if you have no legacy or compatibility requirements, and it should be the only crypto library most web and mobile developers ever come within a mile of. But it's not a workable replacement for OpenSSL.
  • Tomte 13y ago
    What about this from the libsodium web site? "NaCl ships with constructions that were just prototypes, and that shouldn’t be used any more." What does "shouldn't be used any more" mean? Certainly not security, or djb would have released an update. Compatibility with other products? Something else?
    • tptacek 13y ago
      No, IIRC Bernstein improved his public key signing system, and libsodium uses the new version. Neither construction is useful for standard TLS.
• uuid_to_string 13y ago
  For per packet encryption. For authentication, there is CurveCP. People seem confident with OpenSSH's authentication mechanism. Why not use that? At some point one has to trust that the IP address one is sending/retrieving data to/from is the correct one. That's easier said than done if some host wants to keep changing its IP address every few days. The SSL PKI scheme (the SSL approach to authentication), as implemented for public websites, is not much of a confidence-builder, IMO. Opinions may differ. If websites maintained consistent IP addresses and we could authenticate these machines using OpenSSH keys, I would be more willing to believe we could verify their "authenticity".
  • leccine 13y ago
    Exactly. The problem with SSL/TLS that it relies on a broken promise with the CAs, and as we have seen several times it is extremely easy to exploit. Hello rogue CAs.