feat: Switch from AES-GCM to XChaCha20-Poly1305 #305
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR
aes-gcm
lib forchacha20poly1305
Aes256Gcm
struct forXChaCha20Poly1305
aes::Nonce
toXNonce
AesError
intoCryptError
(We still use AES-KW, so a more generic name made sense)aes.rs
file withAesKey
structPrivateRef::to_serializable
andPrivateRef::from_serializable
to just useTemporalKey::key_wrap_{encrypt,decrypt}
The motivation for switching is simply the extended nonce. It let's us always generate a random nonce for every ciphertext and sleep well at night.
The canonical downside of not using AES-based ciphers is performance in case AES native instructions (AESNI) are available. However, this is not our main bottleneck & we'll run in lots of environments (e.g. Wasm) that don't benefit from AESNI.