- Where exactly does "zero-knowledge" play a role here? Does this provide steganography? Or, what is meant?
- Why do they use libsodium (excellent choice, but C) instead of a native Rust crypto library?
- Does this only work with Rust applications?
- Where exactly does "zero-knowledge" play a role here? Does this provide steganography? Or, what is meant?
As I said in https://github.com/zboxfs/zbox/issues/4, this term was originally for marketing purpose. It means no data or metadata can be leaked to underlying storage, so for an outsider there no knowledge about its content. But it turns out many people think it is misleading to zero knowledge proof in cryptography, so I have already changed it "zero-details".
- Why do they use libsodium (excellent choice, but C) instead of a native Rust crypto library?
libsodium is a great library, it is fast, sophisticated, mature and has some advanced crypto features I like, such as Argon2 hash and AES nonce extension. I know there are some Rust crypto libraries are great, but overall it is still young and need improvement.
- Does this only work with Rust applications?
Yes, for now only Rust. But I am considering add FFI interface so it can be used by other languages.
I am not talking about some github repo in some dudes repository which contributes to it in his spare time.
That said, https://crates.io/crates/ring is what most people suggest you should reach for: it's a slow and steady port of BoringSSL's code to Rust + asm. Of course, that only has a subset of crypto; there's other great projects too, the tor people have been putting out crates like https://github.com/isislovecruft/curve25519-dalek
Also, does it really make sense to create a separate crate for every crypto primitive (or small set of primitives)? This has so many obvious disadvantages compared to the "libsodium approach".
I'm not aware of anyone porting libsodium, though it's also not my area of specialty.
What's the alternative? That each individual developer has to pick and combine their favourite set of crypto libs, making crypto libs spread by popularity (which is more often than not a self-fulfilling prophecy) rather than actual quality.
Someone has given it an attempt: https://github.com/jmesmon/sodalite But the port doesn't seem to be too mature yet.
(Edit: For those not aware, Libsodium is based on a portable rewrite of NaCl.)
This is a little too close to how some real official crypto libraries are maintained. OpenSSL for example.