Hacker News Reader

Comment by tptacek | Hacker News Reader

You're wrong. Magic Wormhole is fine, and so is XSalsa. XChacha is barely even a thing; Bernstein formalized extended-nonce Salsa20, but not Chacha20.

View on HN

Wireguard, libsodium, go's crypto libraries and Google's Tink have all implemented xchacha20-poly1305. I would not say that it's not a thing, but I would probably wait at least until the ietf process is over before using it.

I know it exists, and I don't think there's anything wrong with it. It's just weird to demand that everyone use it, since, as I said, it's barely a thing.

Xchacha is used in a corner of WireGuard, fwiw.

Using "one-time-use combinations of three English words" is "fine" only if your definition of "fine" includes allowing someone with a minimal budget to find out the password in less than a year. I am seriously wondering under what definition this could be considered better than OpenPGP.

XSalsa20 is indeed fine, but XChaCha20 is better in every way. The proof for XSalsa20 provided by Bernstein applies to XChaCha20 as well.

> Using "one-time-use combinations of three English words" is "fine" only if your definition of "fine" includes allowing someone with a minimal budget to find out the password in less than a year.

Magic Wormhole uses a PAKE to establish a secure channel from a low-entropy shared secret.

I admit that I missed that part. My mistake, I apologise.

You might also acknowledge your faulty critique of systems that use XSalsa20.

Reply on news.ycombinator.com