On Sun, May 28, 2017 at 1:15 AM, Remko Tronçon <[email protected]> wrote: > Is this really true? You can do *a lot* of branches+memcpys for 3 loops over > all data as far as I know. I would have guessed this was a measure against > timing attacks. Where is this CMov coming from?
In this case I don't *think* timing attacks are important because we're just changing the point from one side of the curve to another and as far as I can see figuring out that we calculated the point on the wrong side isn't valueable information; it's just expected. If you're curious, feel free to ping me out of band ([email protected], email or JID) and I can send you the code it generates; there are definitely no jumps there, and it's actually quite interesting :) > The reason I'm nitpicking is this: even with a single properly licensed > XEdDSA implementation in an unestablished library (or libolm), I still feel > uncomfortable depending a XEP on it. FWIW, the Go crypto libraries may not be as old as OpenSSL, but they're certainly established; besides Google themselves, Cloudflare uses them for all of their TLS traffic and that's a substantial portion of traffic on the web (7% or something is the number I've heard them throw about?). However, I'm not sure this actually matters. > There's a certain amount of uncertainty > whether the author didn't "reuse existing bits of software" (an expression > thrown around a few times on this list recently), perhaps infringing > copyright in the process, making me as a software vendor vulnerable to legal > attacks. I don't beleive this is true; see my response to Dave. > This is why I asked for an implementation in an established crypto > library like OpenSSL or LibSodium, where, besides review of quality, > contributors sign agreements. I would then feel safer that the heat isn't > directly on me if something is wrong copyright-wise with the libraries i'm > using. The Go libraries use Google's standard CLA, so if it's accepted, we'll see. Obviously not everyone is using Go or can use it in this form, but as I said, it was just an example. You could copy/paste the ref10 implementation and use that easily enough, just like OWS did. —Sam _______________________________________________ Standards mailing list Info: https://mail.jabber.org/mailman/listinfo/standards Unsubscribe: [email protected] _______________________________________________
