Hacker News Reader

If designing new crypto stuff, use a mode like GCM (Galois Counter Mode) or EAX. Avoid the old non-authenticated modes.

Both AES and GHASH have their own timing side-channel issues.

If you need to encrypt something, I recommend NaCl: http://nacl.cr.yp.to/

Are you saying that there is an equivalent attack for the AES-GCM TLS 1.2 ciphersuites? If so, paper please :)

There have been cache-based timing attacks on AES; these are hard to stop completely. To the best of my knowledge, this is not a knock on GCM specifically; but I'd be happy to learn more.

Besides the difficulties of patching openssl and nss, what are other technical and political challenges preventing the adoption of djb's crypto primivatives in tls?

They have not been reviewed to anywhere near the extent that AES and co. have been. So few people use them, which makes them less attractive targets for cryptanalysis, and so on.

Also, I'm under the impression that NaCl achieves impressive speeds, but at the cost of using implementations tuned to a specific CPU. This makes the amount of code that has to be reviewed considerably larger.

Reply on news.ycombinator.com