{"action":"created","issue":{"url":"https://api.github.com/repos/alexcrichton/cookie-rs/issues/50","repository_url":"https://api.github.com/repos/alexcrichton/cookie-rs","labels_url":"https://api.github.com/repos/alexcrichton/cookie-rs/issues/50/labels{/name}","comments_url":"https://api.github.com/repos/alexcrichton/cookie-rs/issues/50/comments","events_url":"https://api.github.com/repos/alexcrichton/cookie-rs/issues/50/events","html_url":"https://github.com/alexcrichton/cookie-rs/issues/50","id":159524727,"number":50,"title":"Use an AEAD cipher instead of AES-CBC + HMAC-SHA1","user":{"login":"drbo","id":6395399,"avatar_url":"https://avatars.githubusercontent.com/u/6395399?v=3","gravatar_id":"","url":"https://api.github.com/users/drbo","html_url":"https://github.com/drbo","followers_url":"https://api.github.com/users/drbo/followers","following_url":"https://api.github.com/users/drbo/following{/other_user}","gists_url":"https://api.github.com/users/drbo/gists{/gist_id}","starred_url":"https://api.github.com/users/drbo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/drbo/subscriptions","organizations_url":"https://api.github.com/users/drbo/orgs","repos_url":"https://api.github.com/users/drbo/repos","events_url":"https://api.github.com/users/drbo/events{/privacy}","received_events_url":"https://api.github.com/users/drbo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-06-09T22:41:25Z","updated_at":"2016-06-10T10:27:50Z","closed_at":null,"body":"cookie-rs currently uses AES-256-CBC and then HMAC-SHA1 in encrypt-then-MAC.  This is secure, since AES-256-CBC and HMAC-SHA1 are both individually secure and because they are used in encrypt-then-MAC.\r\n\r\nHowever, neither AES-256-CBC nor HMAC-SHA1 is fast, even when AES is hardware accelerated (due to the serial nature of CBC mode).  ChaCha20-Poly1305 is much faster.\r\n\r\nAgain, cookie-rs's current crypto is not _insecure_, just slow."},"comment":{"url":"https://api.github.com/repos/alexcrichton/cookie-rs/issues/comments/225148434","html_url":"https://github.com/alexcrichton/cookie-rs/issues/50#issuecomment-225148434","issue_url":"https://api.github.com/repos/alexcrichton/cookie-rs/issues/50","id":225148434,"user":{"login":"alexcrichton","id":64996,"avatar_url":"https://avatars.githubusercontent.com/u/64996?v=3","gravatar_id":"","url":"https://api.github.com/users/alexcrichton","html_url":"https://github.com/alexcrichton","followers_url":"https://api.github.com/users/alexcrichton/followers","following_url":"https://api.github.com/users/alexcrichton/following{/other_user}","gists_url":"https://api.github.com/users/alexcrichton/gists{/gist_id}","starred_url":"https://api.github.com/users/alexcrichton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexcrichton/subscriptions","organizations_url":"https://api.github.com/users/alexcrichton/orgs","repos_url":"https://api.github.com/users/alexcrichton/repos","events_url":"https://api.github.com/users/alexcrichton/events{/privacy}","received_events_url":"https://api.github.com/users/alexcrichton/received_events","type":"User","site_admin":false},"created_at":"2016-06-10T10:27:50Z","updated_at":"2016-06-10T10:27:50Z","body":"Ideally this'd actually be configurable rather than only hardcoding one and calling it a day, but I'm somewhat hesitant to deviate away from the source of this, Rails, which is probably much more experienced than I :)"}}
{"actor":{"display_login":"alexcrichton"}}