crypto

> A standard protocol with nonstop changing profile requirements at LE's whim. Who's going to keep updating the software every 3 months to keep up? It really doesn't change that often. And whether this is a "breaking" change is something that's debatable (you shouldn't hard-code the cert lifetime, but I suspect many programs do, so de-facto it may or may not be a breaking change). If you look at the Go implementation for example (https://github.com/golang/crypto/commits/master/acme), then there haven't been any major changes since it was first written in 2018: just bugfixes and basic maintenance tasks. Maybe I missed a commit but it certainly doesn't require 3-month update cycles. You can probably take that 2018 code and it'll work fine today. And since it doesn't hard-code the 90 days it will continue to work in 2028 when this change is

The buffer overflow is in the C version of the algorithm (and likely related to loop condition checks idiomatic to C's for-loops). The Go version is a fresh implementation, not a wrapping of the C version. I'm no Go programmer, but if I'm not mistaken, the Go implementation just eats little slices of the input buffer until no more buffer is left, leaving all the overflow-danger to the Go array implementation: https://github.com/golang/crypto/blob/642fcc37f5043eadb2509c... Possibly not as fast as C, but easier to reason about, I'd say.

The version in the Golang stdlib defaults to a pure-go implementation... unless you're compiling for amd64, in which case you get an assembler variant apparently directly derived from the XKCP package (https://github.com/golang/crypto/blob/master/sha3/keccakf_am...). Slightly concerning news for the (mostly-Golang-based) Ethereum ecosystem, which relies on SHA3-256 for pretty much everything...

I'm not sure something like that is legal: - https://github.com/minio/minio/blob/master/pkg/argon2/argon2.go#L38 - https://github.com/golang/crypto/blob/master/argon2/argon2.go > forked from https://golang.org/x/crypto/argon2 > modified to be used with MinIO under GNU Affero General > Public License 3.0 license that can be found in > the LICENSE file. relicense the file based on a small change and also having two licenses on the same file? I'm not so sure, if the go authors are happy about that. they should probably consult a lawyer...

I believe this commit has background: https://github.com/golang/crypto/commit/d6449816ce06963d9d13... To be fair though, that package was depending on a private API to begin with.

https://github.com/ProtonMail/crypto/issues/21 https://github.com/golang/crypto/compare/master...ProtonMail... They changed defaults. 570d0c5fa7ef500786f15958b39af43af3359719 is interesting: "Add secp256k1 / x25519 / brainpool curves to openpgp".

Presumably they respect that the running program has put the terminal into "raw mode" e.g. with https://github.com/golang/crypto/blob/master/ssh/terminal/ut...

Ah, yes, there are no signatures in x/crypto/nacl. There's https://github.com/agl/ed25519, however it will be slower, as there's no assembly. Edit: oops, looks like signatures were added 2 months ago (https://github.com/golang/crypto/blob/master/ed25519/). (I guess it's the same agl's code). There is a detached version (Sign/Verify).

I'm also wondering the answer to this question. To my understanding, go-crypto is actually maintained separately from the Go stdlib by the Go developers[0]. So why isn't this just a fork of crypto? Why fork the entire language? Why can't this be upstreamed? [0]: https://github.com/golang/crypto

ECDSA is a completely different beast. I'm not aware of a modern password hashing function that would be broken if it was given a non-uniformly random salt. If such function were to be submitted to PHC (https://password-hashing.net/), I would consider it to be a disqualifying factor. For password hashing purposes, salt doesn't need to be uniformly random, the only requirement for salt is to be unique and unpredictable to the attacker (see http://crypto.stackexchange.com/questions/6119/hashing-passw...). Most password hashing functions use a cryptographic hash on salt. This particular function, scrypt, uses one-round PBKDF2-HMAC-SHA256 to mix password and salt: https://github.com/golang/crypto/blob/master/scrypt/scrypt.g... PBKDF2 feeds salt, basically, into SHA256: https://github.com/golang/crypto/blob/master/pbkdf2/pbkdf2.g...

Well, here's the code that Go uses to do elliptic curve encryption: https://github.com/golang/crypto/blob/master/curve25519/squa... It's in assembler, with no comments. It's from Bernstein's code, via Supercop, and is not original to the Go team. A recent effort to formally verify that code, out of Taiwan, Japan, and the Netherlands, found one bug not previously detected by testing. http://delivery.acm.org/10.1145/2670000/2660370/p299-chen.pd... This stuff is really hard to get right.