Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I completely agree with your points but you seem to be missing the point which is: why does OpenPGP's versatility make it a bad candidate?


It is not versatile - multi-purpose - it is weak - general-purpose. "Encrypt/sign these bytes with this cipher, these parameters, and this key" is the least common denominator of cryptographic ability and ignores all the work to build an actual useful cryptographic system around it.

On top of this, its specific interfaces for doing that suck, so you can't even bury it as a safe "primitive" in whatever system you're trying to build (even assuming you wanted to bring in the attack surface of a 25 year old C project).

Something like libsodium is actually versatile in that it offers primitives to build a broad set of safe tools on top of. It does more by doing less.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: