Sodium and Chloride

[00:00:00]
>> If you're going to do crypto in node or the browser, you should probably just use libsodium because it's so easy to mess things up. Otherwise, that it's just not even something that you should do. So libsodium or NaCl, is, a package written by, DJB who's kind of prominent cryptographer.

[00:00:32]
And this library provides a suite of tools that are kind of good quality crypto, so it doesn't have any bad crypto in it. There is a lot of bad crypto even things like elliptic curves, not all of those are created equal. So here I have a list of curves that have known flaws.

[00:00:55]
It so happens that NaCl uses 25519 keys which don't have any known flaws right now. But things like the curve that Bitcoin uses this one, p256k1 has known flaws and whatever. It's probably eventually going to become a problem, I would expect. Maybe not just yet, but who knows what people are doing with these curves?

[00:01:25]
So there's like a lot of details that you kind of like really have to be aware of if you're using something like the node-crypto-api. Make sure the algorithms that you're using are correct and you have to like pack everything in a very specific way. There is all kinds of like padding that you have to be very careful when for example where you're sending things, like you have to frame your messages that they are the right length.

[00:01:50]
But it turns out that's a pretty common way to attack a protocol as well. So it's good to use audited libraries. Unfortunately, there aren't very many ways that I know for doing some of these higher level use cases very well. But, To use libsodium in node in the browser, you can use this package called chloride.

[00:02:15]
So chlorides wraps the NaCl API, so you get all of these crypto_box methods. Unfortunately, these packages don't have very good documentation themselves. But you can read the documentation for the the CAPI and kind of like, think about what it would be in JavaScript. Because, okay, maybe you don't have to pass in a pointer where the data is gonna be stored, but it will return a new buffer.

[00:02:44]
So I see a question on the chat. That is, what is entropy? So entropy is randomness. And if your randomness isn't good enough, then can cause you problems because we use entropy to generate things like key pairs. And if those key pairs aren't secure, if they're predictable, then that means that adversaries can figure out our crypto system and break it Okay, so speaking of entropy, why don't we look at how you can generate a signing keypair and a box keypair.

[00:03:24]
So signing_keypairs are used to verify the integrity of chunks of data with these are algorithms that are related to hashing functions. A crypto box keypair will generate a key pair that's useful if you want to send someone an encrypted message to a public key, you can use crypto box keypair.

[00:03:49]
So I'm gonna go ahead and require chloride in the node repple. And we can do these two methods so we can do crypto_sign_keypair, and we get public key and a secret key. So the public key, we can give anyone. The secret key, of course, all of you have seen this both on the Internet and in this classroom.

[00:04:14]
So it's not a very secret key at all, but usually you wouldn't give this to anyone else. Probably it would only even live on a single system, as a good practice for dealing with secret keys. So if you wanna, for example, write these out to a file, you can save that.

[00:04:33]
And then do for each of the public key buffer and secret key buffer, you can convert them into hex. Or you could convert them to base64 and then you could save them out to a JSON file. That's what I typically do when I'm doing this kind of stuff.

[00:04:48]
So we can generate a JSON string like this, do JSON.stringify({ publicKey, and secretKey, toString('hex'). And now we have some string, we could stick this in a file. We could stick this in IndexedDb as well. Of course, if you do that, you also need to be aware that the server can send you whatever data it wants or a cross site scripting attack on a website could read that key in as well.

[00:05:24]
So it's just a lot of things you have to keep in mind when you're trying to build something that's not horribly insecure, just [LAUGH]