AEADs

Thanks for the feedback. This is why I built it FOSS. On the libraries: Mini Diarium actually does use established, widely audited crates rather than rolling its own primitives. See https://github.com/RustCrypto/AEADs for AES-256-GCM, https://github.com/RustCrypto/password-hashes for key derivation, and https://github.com/dalek-cryptography/curve25519-dalek + https://github.com/RustCrypto/KDFs for the key file ECIES scheme. The thin cipher.rs wrapper just handles nonce prepending with no custom crypto primitives. On key reuse: the master key is intentionally shared across entries (as in Signal, 1Password, etc.), but each encrypt() call generates a fresh 96-bit nonce from the OS CSPRNG, so the (key, nonce) pair is never repeated. That said, I am not a security expert by any means. If you've spotted something concrete, a specific call site,

Monero's primatives are pretty well researched [0]. Of course there is always the chance of bugs in the implimentation but it looks MobileCoin's crypto primatives library has at least been audited [1]. [0] https://www.getmonero.org/resources/research-lab/ [1] https://github.com/RustCrypto/AEADs/issues/87

It's nice to know there are a few "safe" Rust crypto primitives (especially the `ChaCha20+Poly1305` which is also found in `libsodium`): * AES/GCM: https://github.com/RustCrypto/AEADs/tree/master/aes-gcm * ChaCha20+Poly1305: https://github.com/RustCrypto/AEADs/tree/master/chacha20poly... Quoting from the "key findings" of that report: > NCC Group did not find any vulnerability in the audited crates. > > The RustCrypto implementations use all the recommended techniques to achieve constant-time implementations; in particular, the fallback AES implementation (to be used when there are no usable hardware AES opcodes) uses bitslicing to avoid any table lookups at secret-dependent addresses. Similarly, received authentication tags are compared with constant-time comparison functions. > > A few cosmetic remarks, mostly related to potential perfo