End-To-End – OpenPGP Chrome extension from Google • Hacker News Board

Re: End-To-End – OpenPGP Chrome extension from Google

#171

Post by indutny » Thu, Jun 05, 2014, 5:48 AM UTC

cryptbe wrote: post #163

indutny wrote: post #153

Earlier quoted context omitted.

I do expect users to hash the message before passing it to ECDSA, this way you could use any hashing library with it. Though, elliptic.js does actually depends on hash.js to seed it's PRNG. Thank you!

> I do expect users to hash the message before passing it to ECDSA, this way you could use any hashing library with it. Though, elliptic.js does actually depends on hash.js to seed it's PRNG. I think this isn't a good design because most people won't know that they must hash the message before passing it to the ECDSA. People will misuse it, and open themselves to attacks. What you can do instead is to pick the right…

Anyway, it would be interesting to compare speeds of our implementations. I'm really obsessed with try to reach 1ms verification, but so far only got to 4ms.

Re: End-To-End – OpenPGP Chrome extension from Google

#172

Post by tanx » Thu, Jun 05, 2014, 7:42 AM UTC

cryptbe wrote: post #168

tanx wrote: post #167

Earlier quoted context omitted.

Thanks for for reply. I'm wondering if you know if it's possible to use the AES-CFB mode from the Web Crypto Apis, since the OpenPGP CFB (resync) mode seems to have special requirements? > I like WhiteOut. It's a great product in the right direction. We really want and will support the usage of the library in products like yours. Thanks! Is there a guide somewhere that explains how to build the standalone lib?

> Thanks for for reply. I'm wondering if you know if it's possible to use the AES-CFB mode from the Web Crypto Apis, since the OpenPGP CFB (resync) mode seems to have special requirements? I haven't looked into it. > Thanks! Is there a guide somewhere that explains how to build the standalone lib? No, there isn't. But can you file a bug with us? I'll make sure we have something for you. PS: how can I contact you?

My email is tankred@whiteout.io

Re: End-To-End – OpenPGP Chrome extension from Google

#173

Post by hifier » Sat, Jun 14, 2014, 10:20 PM UTC

declan wrote: post #117

hifier wrote: post #101

Earlier quoted context omitted.

I agree that such a thread model makes things difficult, however I'd like to believe that it can be solved for. Regardless, there is value in hiding your communications from mass, non-targeted surveillance.

If you're able to completely "solve for" the threat model of NSA/FBI/GCHQ/CIA/etc. having a serious and persistent interest in you, and knowing where you sleep at night, my hat's off to you. Few people are that confident.

I never implied that I could! Anyway, my comment was concerning communications. Physical security is another matter. I must have missed that portion of your OP.