Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by AJRF | Hacker News Reader

Parent Full thread

AJRF·

In the CIO summary they mention every service uses KeyCZAR.

First line on KeyCZAR repo:

"Important note: KeyCzar has some known security issues which may influence your decision to use it."

https://github.com/google/keyczar#known-security-issues

View on HN

I work at Google. The final bullet in the CIO Summary on Keyczar was a typographical error, taken from our paper on encryption at rest (https://goo.gl/hSordh). It's since been removed from this Security Design Overview. The encryption at rest paper goes into additional detail and includes the important clarification that while a very old version of Keyczar was open-sourced, the open-sourced version has not been updated to reflect internal developments.

Thanks for the reply and follow on information. Wondering why those internal changes didnt get rolled into the public release, especially if they were security focused updates? Lack of adoption of the library maybe?

They could be design decisions that are tailored for Google's use or issues for which Google has other compensating controls.

The first listed issue is "Use of SHA 1 and 1024 bit DSA", which they admit are "considered weak by current security standards".

Not sure why the OP has been downvoted. Definitely something interesting to note.

Like "Use of SHA 1 and 1024 bit DSA". Ouch.

Keyczar is no longer being maintained and should probably be deprecated.

Either that or someone can take the reins and update it to use modern algorithms.

Reply on news.ycombinator.com