Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

But we've engaged with those motivations, and found them lacking -- so libsodium is still what tqbf and I recommend. (Not NaCl! libsodium is sufficiently interestingly different that you should use it, not NaCl.)

It is not true that any attempt at new crypto software will just be shut down; for example, I think Noise is awesome. I think STROBE is pretty cool too, but I'm not telling people to implement STROBE. I'm telling people to use libsodium. Telling people to use the probably-already-packaged, carefully reviewed, random-nonce supporting package they had available yesterday _is_ solid engineering advance, and I stand by that claim.



I definitely agree that going around adopting freshly written and poorly tested crypto libraries is A BAD IDEA EVERY TIME. Absolutely no argument there.

I still got a very "stop what you're doing and move on" vibe from the parent comment as well as the response on the Reddit thread, and I feel that it wasn't fair in this case.

I apologize if I misunderstood.


To go back to said comment to see what was actually said:

> First: it needs to be made clearer why anyone would use this rather than Nacl/Sodium.

... and a comment about how a few test vectors is not a serious cryptographic audit.

So it seems that the parent agrees with you, and nobody told anyone to stop doing what we're doing. The thing we (well, I; I don't want to put words in tqbf's mouth) did say repeatedly, is "the answer is still libsodium". It seems like that, too, is something you agree with.


I'm sure that could have been phrased in a way that got the point across without patronizing the submitter. I wonder how many potentially great cryptographers had their ambitions killed off because of statements like this?


Which patronizing statement? Is "it needs to be made clear..." patronizing? Surely asking why you'd want to use something is reasonable.


> random-nonce supporting package

Wait a minute, what's that? Does it just mean nonces big enough to be random, or something more I should consider for inclusion in Monocypher?


Big enough to be (safely) random. Potentially: NMR.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: