search

funcool / buddy

Security library for Clojure
Apache License 2.0
827 stars 38 forks source link

libsodium support welcome? #12

Closed lvh closed 10 years ago

lvh commented 10 years ago

I was wondering if you're happy with just BouncyCastle (which I totally understand), or if additions like libsodium (through kalium) are welcome.

I'm building something that needs strong symmetric crypto and strong (& fast) key derivation. Conveniently I only need 512 bits of keying material, so I repurposed BLAKE2b. 256 of those bits need to go into an authenticated encryption scheme, so I picked nacl/libsodium's secretbox.

My main reason for wanting secretbox is auditability: if an auditor sees that I'm using secretbox, they don't have to worry about checking if I got authenticated encryption right :-) However, since right now I'm just building a prototype, I can simply compose ChaCha20 + Poly1305-AES, which both seem supported :-)

Would you be interested in bindings to kalium/libsodium as well? (Please don't interpret this as a demand; if you're happy with BouncyCastle, you have every reason to be :-))

lvh commented 10 years ago

(It may be interesting for public key crypto, since you'd get access to Ed25519.)

niwinz commented 10 years ago

Hi @lvh

Any improvements (and additions) are welcome.

libsodiums seems awesome, but in this case requires installing additional system shared library, that makes much more difficult use buddy for simple setups, requiring do more steps for get it running. And this is not really convinced me.

The facility of adding dependency to leiningen and nothing more is very awesome! Furthermore, buddy currently offers good key derivation functions and small subset of symmetric ciphers from bouncy castle. Adding others from bouncycastle is very easy and if you want some other that does not exist on bouncycastle but you knows the existence of java implementation of it, we can view how include support for it in buddy without any problem.

In any case, thank you for suggestion.

lvh commented 10 years ago

Thanks! I'll keep that in mind. Like I said, there's a decent chance I actually end up using buddy anyway because it has all of the stuff I need, and I'm not married to libsodium's stuff :)