To: Henri Sivonen <hsivonen@hsivonen.fi>
References: <2d0a8c01-9f58-1ee7-7e20-53fe65d96718@palant.de>
 <CAJQvAueazfvt9g2nPsqyuzecJXU0BRVs7hyZoqFBdG3bCmxO+w@mail.gmail.com>
From: Wladimir Palant <gtiobnam@palant.de>
Message-ID: <f1809076-4875-1c34-b321-681ccf1b2071@palant.de>
Date: Mon, 3 Jul 2017 21:16:35 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.1.1
MIME-Version: 1.0
In-Reply-To: <CAJQvAueazfvt9g2nPsqyuzecJXU0BRVs7hyZoqFBdG3bCmxO+w@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Cc: obnam-dev@obnam.org
Subject: Re: [rfc] Passphrase-based encryption
Precedence: list
Sender: obnam-dev-bounces@obnam.org
Errors-To: obnam-dev-bounces@obnam.org

On 03.07.2017 20:29, Henri Sivonen wrote:
> If you don't need AES specifically, you can find an XSalsa20+Poly1305
> implementation at:
> https://github.com/hsivonen/obnam/compare/salsa?expand=1

Interesting, thank you for sharing. This is way more advanced than my 
quick and dirty plugin of course.

> I haven't had the time to write proper unit tests, benchmarks or docs,
> which is why I haven't tried upstreaming it.

Unfortunately, I assume that the arguments against upstreaming my 
solution apply to yours just as well - so even with tests, benchmarks 
and docs it won't get accepted.

> Probably more important that letting users tweak the key size is to
> make sure that the AEAD construction is good and suitable for use with
> a randomly-generated nonce for the amount of data one would expect to
> encrypt using Obnam. I don't know if CFB fits this, but
> XSalsa20+Poly1305 or XChaCha20+Poly1305 should (the non-X variants of
> Salsa20 and ChaCha20 *don't*).

CFB uses initialization vectors (randomly generated for each file in my 
case) which I think serve a similar purpose. But I'm not really familiar 
with either Salsa20 or ChaCha20 so I would be grateful if you could 
expand. What kind of issues is this about? Are you implying that these 
algorithms would be better performance-wise? I don't really know how 
they compare to AES but at least for me the performance is clearly 
limited by the uplink and not by the CPU. In other scenarios it could be 
completely different of course.

regards
Wladimir

_______________________________________________
obnam-dev mailing list
obnam-dev@obnam.org
http://listmaster.pepperfish.net/cgi-bin/mailman/listinfo/obnam-dev-obnam.org