{"action":"created","issue":{"url":"https://api.github.com/repos/PrivateBin/PrivateBin/issues/25","repository_url":"https://api.github.com/repos/PrivateBin/PrivateBin","labels_url":"https://api.github.com/repos/PrivateBin/PrivateBin/issues/25/labels{/name}","comments_url":"https://api.github.com/repos/PrivateBin/PrivateBin/issues/25/comments","events_url":"https://api.github.com/repos/PrivateBin/PrivateBin/issues/25/events","html_url":"https://github.com/PrivateBin/PrivateBin/issues/25","id":164664814,"number":25,"title":"Libsodium","user":{"login":"rugk","id":11966684,"avatar_url":"https://avatars.githubusercontent.com/u/11966684?v=3","gravatar_id":"","url":"https://api.github.com/users/rugk","html_url":"https://github.com/rugk","followers_url":"https://api.github.com/users/rugk/followers","following_url":"https://api.github.com/users/rugk/following{/other_user}","gists_url":"https://api.github.com/users/rugk/gists{/gist_id}","starred_url":"https://api.github.com/users/rugk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rugk/subscriptions","organizations_url":"https://api.github.com/users/rugk/orgs","repos_url":"https://api.github.com/users/rugk/repos","events_url":"https://api.github.com/users/rugk/events{/privacy}","received_events_url":"https://api.github.com/users/rugk/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/PrivateBin/PrivateBin/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/PrivateBin/PrivateBin/labels/security","name":"security","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-07-09T12:22:00Z","updated_at":"2016-07-09T18:03:18Z","closed_at":null,"body":"So currently we use AES. But in which mode is it used? See e.g. [how Owncloud did it](https://blog.hboeck.de/archives/880-Pwncloud-bad-crypto-in-the-Owncloud-encryption-module.html), which was a problem.\r\n\r\nThe mode should also be documented in the Readme...\r\n\r\nBecause PHP does not support AES in GCM mode yet, but GCM has many advantages - the biggest one being that it is authenticated encryption so it cannot be modified.\r\n\r\nHowever there is a method to use GCm mode right now, but it requires [libsodium](https://download.libsodium.org/doc/) installed on the server. However libsodium is a great cryptographic tool with many features and they have a [PHP wrapper](https://github.com/jedisct1/libsodium-php).\r\nSo we could e.g. even switch to [ChaCha20-Poly1305](https://download.libsodium.org/libsodium/content/secret-key_cryptography/chacha20-poly1305.html). Libsodium also allows one to use better hashing algorithms, a strong way [to generate random numbers](https://download.libsodium.org/libsodium/content/generating_random_data/) and even using the memory [securly](https://download.libsodium.org/libsodium/content/helpers/memory_management.html) is possible.\r\n\r\nWe should evaluate whether/what/how we want to use (it)."},"comment":{"url":"https://api.github.com/repos/PrivateBin/PrivateBin/issues/comments/231547333","html_url":"https://github.com/PrivateBin/PrivateBin/issues/25#issuecomment-231547333","issue_url":"https://api.github.com/repos/PrivateBin/PrivateBin/issues/25","id":231547333,"user":{"login":"rugk","id":11966684,"avatar_url":"https://avatars.githubusercontent.com/u/11966684?v=3","gravatar_id":"","url":"https://api.github.com/users/rugk","html_url":"https://github.com/rugk","followers_url":"https://api.github.com/users/rugk/followers","following_url":"https://api.github.com/users/rugk/following{/other_user}","gists_url":"https://api.github.com/users/rugk/gists{/gist_id}","starred_url":"https://api.github.com/users/rugk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rugk/subscriptions","organizations_url":"https://api.github.com/users/rugk/orgs","repos_url":"https://api.github.com/users/rugk/repos","events_url":"https://api.github.com/users/rugk/events{/privacy}","received_events_url":"https://api.github.com/users/rugk/received_events","type":"User","site_admin":false},"created_at":"2016-07-09T18:03:18Z","updated_at":"2016-07-09T18:03:18Z","body":"Ah of course. I am stupid. :laughing: \r\n\r\nSo I am splitting this issue as Libsodium still would maybe provide some advantages."}}
{"actor":{"display_login":"rugk"}}