[{"data":1,"prerenderedAt":205},["ShallowReactive",2],{"project-13415917":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":34,"aspects":35,"strip":38,"post_text":30,"what":41,"said":71,"maker_in_thread":121,"shape":126,"grid":130,"attempts":153,"same_week":167,"maker_shows":34,"maker_hidden":198,"reader_version":199,"card":200},"13415917","Sodium_compat","A Pure PHP implementation of libsodium","title","Show HN: Sodium_compat, a Pure PHP implementation of libsodium","https:\u002F\u002Fgithub.com\u002Fparagonie\u002Fsodium_compat","github.com","CiPHPerCoder",1484642089,2017,62,10,682,2242,31,"notable","security_privacy","cryptography library","library",[24,25,26,27,28],"libsodium","php cryptography","ed25519","constant time","pure php","quiet",null,{"positive":32,"neutral":33,"mixed":33,"critical":32},2,0,4,{"privacy":36,"idea":37},{"positive":33,"critical":32},{"positive":32,"critical":33},[33,33,39,39,33,33,33,33,40,40],1,5,{"problem":42,"audience":49,"pricing":30,"motivation":58,"time_to_build":30,"stack":65,"openness":70,"stage":70,"team_size":70},{"value":43,"source":44,"evidence":45},"PHP projects cannot require the libsodium extension because hosts may not install native libs","maker",[46],{"id":47,"by":11,"text":48},"13417023","> Implementing crypto primitives in an interpreted language is full of hazards for side channel attacks - being constant time is just the first step. Cache behavior, branch…",{"value":50,"source":51,"evidence":52},"PHP developers, including WordPress core","inferred",[53,57],{"id":54,"by":55,"text":56},"13416042","Mojah","This implementation will hopefully also make it in WordPress core for signed updates: https:\u002F\u002Fma.ttias.be\u002Fwordpress-get-secure-cryptographic-updates\u002F",{"id":47,"by":11,"text":48},{"value":59,"source":44,"evidence":60},"Compatibility, so Ed25519-signed updates can reach projects like WordPress and users can move off mcrypt and unauthenticated AES-CBC",[61,64],{"id":62,"by":11,"text":63},"13415978","Some background reading for deeply interested parties: https:\u002F\u002Fwww.sitepoint.com\u002Fwhat-would-you-pay-to-make-27-of-the-web-more-secure\u002F…",{"id":47,"by":11,"text":48},[66],{"value":67,"source":44,"evidence":68},"PHP",[69],{"id":62,"by":11,"text":63},"unknown",{"praise":72,"objections":85,"requests":100,"questions":109,"alternatives":116},[73,81],{"value":74,"source":75,"evidence":76},"Lesser-of-two-evils approach to bringing modern signatures to PHP","commenter",[77],{"id":78,"by":79,"text":80},"13417078","exDM69","You seem to have taken a \"lesser of two evils\" approach and that's probably a good idea. Side channels are not as bad as completely broken crypto, as long as the critical…",{"value":82,"source":75,"evidence":83},"Maker committed to not tagging v1.0.0 if it cannot be made secure",[84],{"id":78,"by":79,"text":80},[86,96],{"value":87,"source":75,"evidence":88},"Side-channel and constant-time risks from implementing crypto in an interpreted language",[89,93],{"id":90,"by":91,"text":92},"13416913","zx2c4","Curve25519 in pure PHP? Yikes. Have you done any measurements to verify that the implementation is constant time?…",{"id":94,"by":79,"text":95},"13416958","Yikes indeed. Implementing crypto primitives in an interpreted language is full of hazards for side channel attacks - being constant time is just the first step. Cache behavior,…",{"value":97,"source":75,"evidence":98},"Pure PHP crypto is a poor justification for a new crypto library",[99],{"id":94,"by":79,"text":95},[101,105],{"value":102,"source":75,"evidence":103},"Measurements showing the implementation is constant time",[104],{"id":90,"by":91,"text":92},{"value":106,"source":44,"evidence":107},"Third-party audit",[108],{"id":47,"by":11,"text":48},[110],{"value":111,"source":44,"evidence":112},"How to measure timing leaks in PHP code",[113],{"id":114,"by":11,"text":115},"13417052","I'm aware of the recent curve25519-donna on 32-bit MSVC research, but PHP uses a different instruction than llmul (smull), so I'm not sure if that particular research is a…",[117],{"value":118,"source":75,"evidence":119},"Native libsodium PHP extension",[120],{"id":94,"by":79,"text":95},{"comments":34,"answered":32,"key":122},[123,124,125],{"id":62,"text":63},{"id":47,"text":48},{"id":114,"text":115},{"commenters":127,"max_depth":34,"maker_replies":34,"first_comment_mins":128,"lifespan_hours":129},6,13,11,[131,135,137,139,140,141,143,145,148,150],[132,33,33,133,134,33],"13415970","commenter\u002Fneutral\u002Fperformance","orbifold",[62,33,33,136,11,39],"maker\u002Fpositive\u002Fidea",[90,39,39,138,91,33],"project\u002Fcritical\u002Fprivacy",[94,39,39,138,79,33],[47,39,33,136,11,39],[78,39,33,142,79,33],"commenter\u002Fmixed\u002Fidea",[114,39,33,144,11,39],"maker\u002Fneutral\u002Fprivacy",[146,39,33,147,11,39],"13420633","other\u002Fneutral\u002Fprivacy",[54,32,40,149,55,33],"project\u002Fpositive\u002Fidea",[151,32,40,149,152,33],"13416657","rmccue",[154,157,160,161,164],{"id":155,"t":156,"points":32,"comments":39},"13376850",1484163806,{"id":158,"t":159,"points":39,"comments":33},"13382958",1484235145,{"id":4,"t":12,"points":14,"comments":15},{"id":162,"t":163,"points":32,"comments":33},"14527807",1497110604,{"id":165,"t":166,"points":39,"comments":33},"14539391",1497290560,[168,173,178,183,188,193],{"id":169,"name":170,"points":171,"category":172},"13423629","SkyTorrents",1183,"data",{"id":174,"name":175,"points":176,"category":177},"13406081","Crafting Interpreters",423,"learning_science",{"id":179,"name":180,"points":181,"category":182},"13412737","JSON Browse",138,"dev_tools",{"id":184,"name":185,"points":186,"category":187},"13384012","Hypergolix",130,"infrastructure",{"id":189,"name":190,"points":191,"category":192},"13390135","Skeletal Animation System",120,"creative",{"id":194,"name":195,"points":196,"category":197},"13421703","ChatSecure iOS v4.0",107,"productivity",false,"v2",{"id":201,"name":5,"line":6,"ai":198,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":30,"top":18,"kw":202,"maker":11,"domain":10,"tier":19,"attempts":40,"strip":203,"url":9,"mix":204,"praise":74,"objection":87,"sub":21},13415917,[24,25,26,27,28],"0011000055",[32,33,33,32],1794036551727]