Comment

Comment by fulafel

Glancing at your crypto implementation[1], it seems to contain newbie mistakes - eg no public key crypto involved in your public keys, usage of low level raw crypto algorithm primitives from libsodium without session, replay etc related security concerns, no signs of design requiremnts re what security guarantees it's trying to provide, no PK key management, etc. You're also hand rolling wire protocol code in C++, manipulating raw bytes and lengths, which is a receipe for memory safety vulnerabilities.

Use an pre vetted implementation of a good security protocol for this, or if this is a hobby project, spend some time reading up on crypto protocol design.

[1] https://github.com/LANDrop/LANDrop/blob/master/LANDrop/crypt...

parent fulafel 5 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton