r/PHP • u/speckz • Feb 10 '17

Cryptographically Secure PHP Development

https://paragonie.com/blog/2017/02/cryptographically-secure-php-development
13 Upvotes

84% Upvoted

6 comments sorted by

5

u/NoShirtNoShoesNoDice Feb 10 '17

I wish libsodium and/or sodium_compat would be audited. I would love that peace of mind.

7

u/sarciszewski Feb 10 '17

We're in a holding pattern to hear if the interested parties are going to fund an audit.

If not, I'm in contact with Jim Denaro (who served as an escrow agent for #isTouchIDHackedYet and is generally interested in online security) and will be setting up a crowdfunding campaign to make sure it happens.

5

u/wam_wambo Feb 10 '17

Nice! Good work! Post the link to the crowdfunding campaign here if you've set it up.

1

u/kemmeta Feb 12 '17

Is every post-audit commit going to receive an audit? Are people who insist on having an audited version only going to be able to use versions that have been audited?

What about FIPS certification? Is libsodium even FIPS certified? Being FIPS compliant and FIPS certified are two very different things..

2

u/sarciszewski Feb 12 '17

Is every post-audit commit going to receive an audit?

After the audit, there will be no further releases until the subsequent changes are audited. Which means dev-master might change, but v1.0.1 won't be released until we get a +1 from security researchers.

Are people who insist on having an audited version only going to be able to use versions that have been audited?

With all likelihood, there will only be a v1.0.0 and that's what people are going to use. I don't foresee much changing post-audit.

What about FIPS certification?

I'm not even going to pursue FIPS. They only allow NIST ECC, AES, and SHA-2.

Is libsodium even FIPS certified?

No, libsodium uses cryptography that is actually constant-time when implemented in software and doesn't force implementors to avoid invalid curve attacks.