Are these algorithms resistant to quantum attacks?
Pretty Curved Privacy
21–30 of 47 posts
Re: Pretty Curved Privacy
#22My question is: People don't even use PGP and it's been around for over 20 years. What makes this more adoptable, if it all? The problem with most encryption is, it's not transparent to the end user. The second users have to start goofing around with key generation, uploading keys, etc you lost. I get that using Curve25519 is "better" but none of this still solves the fundamental problem of end user adoption.
From the README:
> In fact, I wrote it just to learn about the curve and see how it works.
I don't think the author seriously considers replacing PGP with this.
Re: Pretty Curved Privacy
#23Are these algorithms resistant to quantum attacks?
not the curve25519 based ones, the symmetric salsa based ones should be.
Re: Pretty Curved Privacy
#24Are these algorithms resistant to quantum attacks?
[deleted]
Re: Pretty Curved Privacy
#25This package, by Watson Ladd, is the same idea implemented by an expert: https://github.com/wbl/cpgb
The use of the word "expert" here gives me pause. I thought one of the motivations behind this library was that you did not need to be an "expert" to use it.
While NaCl/Sodium does simplify the crypto aspect in particular, it's dangerous to assume that it entirely solves the broader problem of writing secure code. Implementing anything securely is hard enough before involving crypto that the level of expertise required doesn't change all that much. (Most catastrophic vulnerabilities in security software aren't directly in the cryptographic implementations.)
Even using NaCl, one needs to understand enough of what's happening under the hood to properly reason about the security of the whole system they've built.
Re: Pretty Curved Privacy
#26Are these algorithms resistant to quantum attacks?
not the curve25519 based ones, the symmetric salsa based ones should be.
Cool. I suspect that's going to start being a problem in the next decade or two, assuming that government entities haven't already made sophisticated quantum computers in secret.
Re: Pretty Curved Privacy
#27Earlier quoted context omitted.
The use of the word "expert" here gives me pause. I thought one of the motivations behind this library was that you did not need to be an "expert" to use it.
While NaCl/Sodium does simplify the crypto aspect in particular, it's dangerous to assume that it entirely solves the broader problem of writing secure code. Implementing anything securely is hard enough before involving crypto that the level of expertise required doesn't change all that much. (Most catastrophic vulnerabilities in security software aren't directly in the cryptographic implementations.) Even using NaC…
Agreed. Now kindly point to the mistakes the author has made so others can learn from them.
Re: Pretty Curved Privacy
#28Earlier quoted context omitted.
While NaCl/Sodium does simplify the crypto aspect in particular, it's dangerous to assume that it entirely solves the broader problem of writing secure code. Implementing anything securely is hard enough before involving crypto that the level of expertise required doesn't change all that much. (Most catastrophic vulnerabilities in security software aren't directly in the cryptographic implementations.) Even using NaC…
Agreed. Now kindly point to the mistakes the author has made so others can learn from them.
I wasn't actually commenting on this project in particular or whether or not the author happens to be an expert (tptacek may have more to say about that), just on the idea of NaCl as a replacement for expertise.
Re: Pretty Curved Privacy
#29Earlier quoted context omitted.
While NaCl/Sodium does simplify the crypto aspect in particular, it's dangerous to assume that it entirely solves the broader problem of writing secure code. Implementing anything securely is hard enough before involving crypto that the level of expertise required doesn't change all that much. (Most catastrophic vulnerabilities in security software aren't directly in the cryptographic implementations.) Even using NaC…
Agreed. Now kindly point to the mistakes the author has made so others can learn from them.
"If you can't immediately point out the flaws in this software, it must not have any."
Re: Pretty Curved Privacy
#30Earlier quoted context omitted.
Agreed. Now kindly point to the mistakes the author has made so others can learn from them.
I wasn't actually commenting on this project in particular or whether or not the author happens to be an expert (tptacek may have more to say about that), just on the idea of NaCl as a replacement for expertise.
NaCl/libsodium solve a low-level problem that even very few talented engineers with years of software security experience can be expected to get right on their own.
Using these features should still be done under the guidance of someone who knows what they're doing. There's a larger number of developers who can use libsodium than there are developers who could replace it on their own.
In a sense, NaCl/libsodium can be viewed as a "replacement for expertise" that is so rare it's nigh-nonexistent. (To wit: these libraries were created by multiple authors.) Rather, it places the capability to build solid application-layer crypto into the hands of mere mortals.
That doesn't obviate the need for good mortals. :)