[dev] securiy guidance

2018-03-05 Thread petern
Hello, this mail won't be related to any suckless projects, I am looking for some guidance/tips. If this isn't a good place for such requests I can take a hint. Since I stumbled upon suckless.org (2-3 weeks) I switched to dwm and st, read the philosophy and many other pages, browsed through some

Re: [dev] securiy guidance

2018-03-05 Thread petern
On 2018-03-05 15:15, Kart Etlinger wrote: > Well, all those problems can be solved by pass-tomb addon, but it uses > zsh, which may be some problem for people who dislike zsh as coding > language. > So yes, the entire password store should be kept in one encrypted file > and so it can be opened and

Re: [dev] securiy guidance

2018-03-06 Thread petern
Hi Thomas, On 2018-03-06 00:57, Thomas Levine wrote: > If you copy (vendor) an encryption/decryption algorithm into your source > code, then you are relying on more than libc. So perhaps you could > expand your dependencies to libraries with acceptable licensing or > to libraries that are widely a

Re: [dev] securiy guidance

2018-03-06 Thread petern
On 2018-03-06 10:01, Truls Becken wrote: > Some libraries to look at are; libressl, libtomcrypt, nacl.cr.yp.to, > libsodium, nettle, libgcrypt and libmcrypt. Hello Truls, thank you for this list. I was hoping there would be a publicly available algo that could be inlined in the source since I rea

Re: [dev] securiy guidance

2018-03-07 Thread petern
On 2018-03-07 00:23, Michael Forney wrote: > Another related project I've been following is https://monocypher.org/ > > It has a quite permissive license and encourages inlining the source > like you want. Hi Michael, thanks, this looks really nice and small. I'm doing my homework reading crypto

Re: [dev] securiy guidance

2018-03-07 Thread petern
On 2018-03-08 06:57, Markus Teich wrote: > pet...@riseup.net wrote: >> I have to yet read up if it is safe to use >> with a single key, i.e. encrypting n passwords with the same secret key. > > Make sure to use salting in this case. Otherwise using the same > password for multiple sites/keys would

Re: [dev] securiy guidance

2018-04-03 Thread petern
On 2018-03-10 03:59, Markus Teich wrote: > Am 2018-03-08 18:47, schrieb pet...@riseup.net: >> Looking at the chacha API one needs to use a nonce, in the monocypher >> implementation it is 24 bits wide, which would give the option of almost >> 17M runs with a single key. IIUC adding a salt would fur