apage43
commented
13 years ago What they are doing is generating an aes key and iv and serializing that pair as json, then encrypting it using a public key encryption library before storing it along side the ciphertext, which is created from an arbitrary (not necessarily JSON) cleartext.
They just happen to have JSON in their crypto innards for no apparent reason.
Fun fact: the library they encrypt the base64->json'ified key with does the same thing to it. Public key crypto is slow; When you encrypt something use a public key crypto library, it generates a random key for AES or some other symmetric crypto algo, encrypts that key (which is pretty small compared to most ciphertexts) with the asymmetric key, and encrypts your input with the symmetric algo and returns the output of that along with the encrypted version of the key. So Diaspora's crypto code basically duplicates what the crypto library they use already does, except in a non-standard way that hasn't been vetted for security. Their implementation has already been found to vulnerable to certain attacks.
TL;DR: Copying Diaspora's crypto code is probably not a good idea. Encryption is though, just don't be silly about it.
victusfate
max-mapper
Investigate encrypting JSON during server -> client communication and server -> server replication. Diaspora is simply encrypting JSON http://github.com/diaspora/diaspora/blob/master/lib/encryptor.rb#L41