Responsibly Bringing a new Cryptography Product to Market
1–10 of 30 posts
Re: Responsibly Bringing a new Cryptography Product to Market
#2This is critical. If you don't think about this stuff, use the existing code.
Re: Responsibly Bringing a new Cryptography Product to Market
#3Some programming efforts can be casual, some can not. Cryptography is is one that often requires not just rigor, but also expensive investment. The combination can be an obstacle to open source inroads. I'm part of SpiderOak, and proud of their investment in Crypton. It is expensive - like, not just the coding, but sponsoring these audits - but, I believe, extremely valuable.
Re: Responsibly Bringing a new Cryptography Product to Market
#4Glad to see real numbers and specifics about the audit being used in the post.
Re: Responsibly Bringing a new Cryptography Product to Market
#5By the way, once we've established confidence in the code directly included in the project, we're hoping to also arrange audits for some of the popular crypto libraries involved such as SJCL.
Re: Responsibly Bringing a new Cryptography Product to Market
#6By the way, once we've established confidence in the code directly included in the project, we're hoping to also arrange audits for some of the popular crypto libraries involved such as SJCL.
Have any of those libraries been audited so far? Seems like a necessary step for widespread js crypto.
Re: Responsibly Bringing a new Cryptography Product to Market
#7Glad to see real numbers and specifics about the audit being used in the post.
For people to give a crap about FOSS crypto, you need the audits, and there's just not that much information out there. Audits are pricy and a great way to prematurely age a developer team, but the alternative is "looks OK" crypto code like the Debian SSL debacle.
Crypton's definitely an effort at all-cards-on-the-table corporate-sponsored FOSS, and this includes the project itself and not just the code.
Re: Responsibly Bringing a new Cryptography Product to Market
#8It's interesting to see what's involved in a security audit and how much it costs. It's nice to see this kind of information being freely given.
Re: Responsibly Bringing a new Cryptography Product to Market
#9By the way, once we've established confidence in the code directly included in the project, we're hoping to also arrange audits for some of the popular crypto libraries involved such as SJCL.
Have any of those libraries been audited so far? Seems like a necessary step for widespread js crypto.
SJCL had substantial peer review during its development, but I'm not aware of a public 3rd party audit from a security firm.
Oh yeah, and before people with torches show up, let me clarify that is a Javascript based crypto product but not browser and website based crypto. The deployment target is situations where the code delivery problem is solved: HTML5 mobile apps (including phonegap / cordova), desktop apps with things like AppJS, browser extensions, etc. It's a high level secure-by-default framework for building collaborative realtime and storage applications. Javascript is a natural language for this, because the framework provides storage through an object database, and that approach is natural an convenient in Javascript. We're spending the time and money to make a secure framework now so we don't have to spend quite as much time in reinvention and security review for each new crypto application we build.
Re: Responsibly Bringing a new Cryptography Product to Market
#10By the way, once we've established confidence in the code directly included in the project, we're hoping to also arrange audits for some of the popular crypto libraries involved such as SJCL.
Have any of those libraries been audited so far? Seems like a necessary step for widespread js crypto.
Not that we can find evidence of. SJCL is written by some of the best security people around. I have confidence in it - running in a "safe" runtime like a cordova app or extension. This is a library used by so many - it makes sense to try to crowd-fund an ongoing set of audits.