Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I'm under the impression that Go's original crypto libs were written by none other than djb himself. Is there a rationale for the deficiencies laid out in the OP, or am I putting djb on too much of a pedestal?


The libraries were originally written by Adam Langley, who did a great job compared to the state of the art at the time. They have been serving us well for over 13 years.

Bernstein was never involved.


Interesting, could have sworn I heard this back in 2011 or so, but searching for a source now I have no clue how I got that impression. :) Thank you!


> Is there a rationale for the deficiencies laid out in the OP

Yes. The previous package had a dependency on the general purpose math/big package which was not constant-time and had a large surface area (that was not required for crypto). This has lead to security bugs in the crypto package.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: