Re: Idle musings on doing E over again

I think the lack of perfect forward secrecy is a significant issue. Is
there a good way to provide it within this framework?

Note that E's current VatTP has always provided perfect forward secrecy
(thanks Bill and Tyler!) and there are std TLS cyphersuites that do as well.

On Wed, Oct 3, 2012 at 10:05 AM, Brian Warner <warner-rGj/[email protected]> wrote:

> On 10/1/12 7:16 PM, Bill Frantz wrote:
>
> > I found the whole library thing a total none-starter. What TLS
> > libraries will be supported over all the target platforms? What
> > libraries provide the necessary interfaces to check the public key
> > against the vatID? I'm probably really old fashioned, but coding the
> > crypto from scratch seems a lot easier than answering the above
> > questions and validating the security of a library.
>
> As I mentioned on the captalk list last month, I'd be inclined to use
> djb's NACL library (http://nacl.cr.yp.to/) to get
> non-connection-oriented pair-wise encrypted sessions:
>
>  http://www.eros-os.org/pipermail/cap-talk/2012-September/015386.html
>
> It's a lot smaller than OpenSSL (easy to embed in your app), and isn't
> trying to accomodate legacy compatibility (which removes a large attack
> surface). It also enables store-and-forward relaying of messages,
> instead of requiring real-time live connections, which is a better fit
> for Waterken's "one message at a time" style (but could still be used
> with E's "live references which can die" style).
>
> On the other hand, it doesn't immediately provide perfect forward
> secrecy (ephemeral session keys, which isn't the default in SSL, but is
> theoretically achievable). And you might feel obligated to convince
> somebody that Curve25519/Salsa20/Poly1305 is secure despite being less
> well-known than RSA/AES/HMAC.
>
>
> cheers,
>  -Brian
> _______________________________________________
> e-lang mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/e-lang
>



-- 
    Cheers,
    --MarkM

_______________________________________________
e-lang mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/e-lang