📝 Correction | Unknown encryption curve used by croc #2385

New Issue

2021-07-21T18:28:39Z

rad1ke commented

2021-07-21 18:28:39 +00:00

(Migrated from github.com)

Description

The default encryption curve that croc uses is called SIEC and is completely unknown amongst cryptographers and there are only a handful of people who researched or mentioned this curve. A general recommendation in the security and cryptography space is to use known, researched and audited encryption curves. These can be curves like the NIST curves which fortunately are supported by croc, but optional. croc's README.md mentions that it is a lesser known curve and provides options to change to other curves. The user should be made aware of the default encryption curve used.

Why I am making the suggestion

Encryption plays a big role for file sharing applications like croc where data can be sent internationally across various networks. It is important to make sure that this data stays encrypted securely.

My connection with the software

I personally have used the software and found it very practical.

I will keep the issue up-to-date if something I have said changes or I remember a connection with the software.

## Description The default encryption curve that croc uses is called SIEC and is completely unknown amongst cryptographers and there are only a handful of people who researched or mentioned this curve. A general recommendation in the security and cryptography space is to use known, researched and audited encryption curves. These can be curves like the NIST curves which fortunately are supported by croc, but optional. [croc's README.md](https://github.com/schollz/croc/blob/master/README.md#change-encryption-curve) mentions that it is a lesser known curve and provides options to change to other curves. The user should be made aware of the default encryption curve used. ## Why I am making the suggestion Encryption plays a big role for file sharing applications like croc where data can be sent internationally across various networks. It is important to make sure that this data stays encrypted securely. ## My connection with the software I personally have used the software and found it very practical. - [x] I will keep the issue up-to-date if something I have said changes or I remember a connection with the software.

This repo is archived. You cannot comment on issues.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: privacyguides/privacytools.io#2385