2 ms·
A community should raise money to have libsodium audited by professional crypto auditors. I'm not sure appealing to the ease of implementing DJB's theories is
by sillysaurus3 12y ago
A community should raise money to have libsodium audited by professional crypto auditors. I'm not sure appealing to the ease of implementing DJB's theories is a good idea given how screwed up a lot of the crypto in the field actually is.
All I'm saying is, in general, crypto is hard, and an easy theory doesn't change how hard it is to get an implementation exactly right.
- tptacek 12y agoI don't think this is a great use of crypto auditor time, for what it's worth. Microsoft SecureChannel, Truecrypt, libOTR, GnuPG, PHP mcrypt --- all much more important audit targets.
- sillysaurus3 12y agoAh, good point. GnuPG hasn't been audited? Huh.
- sanderjd 12y agoIs that because of those projects being more widespread or less innately trustworthy or both?
- tptacek 12y agoLittle of both, depending on the project.