Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:90465
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain paragonie.com from 209.85.215.49 cause and error)
MIME-Version: 1.0
In-Reply-To: <5692CDB6.5050905@gmail.com>
References: <CAKws9z1g24rD=t92+9xKtO=3PuwQ3_N=L36gmVMqCC84CoqipQ@mail.gmail.com>
	<CAEZPtU7-Lk=jGsTQgRZOvBpcPPgdX3V-23=3_k9CXbmxU77V1A@mail.gmail.com>
	<CAKws9z248Kj=0qTLPZik0Ki1_zGPq+4fr6HQi_keeVCso1S4eQ@mail.gmail.com>
	<5692CDB6.5050905@gmail.com>
Date: Sun, 10 Jan 2016 16:41:25 -0500
Message-ID: <CAKws9z1e_+XOzsojz9gW-zzswhaK7h+HothhTWWVSvDQXri2zA@mail.gmail.com>
To: Rowan Collins <rowan.collins@gmail.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC] Libsodium
From: scott@paragonie.com (Scott Arciszewski)

On Sun, Jan 10, 2016 at 4:31 PM, Rowan Collins <rowan.collins@gmail.com> wrote:
> On 07/01/2016 16:11, Scott Arciszewski wrote:
>>
>> I'm personally not going to bother pushing
>> for a pluggable crypto API if the only option is to use OpenSSL and
>> all its legacy cruft.
>
>
> I think what people are suggesting is not that libsodium shouldn't be
> supported under-the-hood, just that the fact you're using it shouldn't be
> exposed to userland. A PDO-like encryption interface (which as I understand
> it is not what you proposed in your other thread) would allow us to add
> libsodium in such a way that a relatively painless migration path can be
> created if it goes the way of mcrypt. So the pluggable API removes the need
> for any of the sodium_* / Sodium::* / \Sodium\* functions.
>
> Regards,
>
> --
> Rowan Collins
> [IMSoP]
>
>
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>

Hi Rowan,

> I think what people are suggesting is not that libsodium shouldn't be
> supported under-the-hood, just that the fact you're using it shouldn't be
> exposed to userland.

These are separate concerns. Let's call them Sodium and SimpleSodium.

With Sodium, power users gain the ability to write software that
directly uses low-level primitives in PHP without requiring their
users to install dependencies (i.e. from PECL). Halite 2.0.0 is going
to ship with an API for Axolotl, which is the ratcheting protocol used
by Signal (formerly TextSecure + RedPhone). Being able to offer Signal
integration in SMS-based two factor authentication schemes is a very
attractive proposition; even moreso if Sodium is a core extension.

SimpleSodium is a driver for the simple cryptography wrapper. You can
have SimpleSodium without Sodium, but if we don't get Sodium into core
I will, personally, not be putting forth one more ounce of time or
effort into helping the PHP core so who knows maybe not?

Scott Arciszewski
Chief Development Officer
Paragon Initiative Enterprises <https://paragonie.com>