Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:90469
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.49 as permitted sender)
References: <CAKws9z1g24rD=t92+9xKtO=3PuwQ3_N=L36gmVMqCC84CoqipQ@mail.gmail.com>
 <CAEZPtU7-Lk=jGsTQgRZOvBpcPPgdX3V-23=3_k9CXbmxU77V1A@mail.gmail.com>
 <CAKws9z248Kj=0qTLPZik0Ki1_zGPq+4fr6HQi_keeVCso1S4eQ@mail.gmail.com>
 <5692CDB6.5050905@gmail.com>
 <CAKws9z1e_+XOzsojz9gW-zzswhaK7h+HothhTWWVSvDQXri2zA@mail.gmail.com>
 <5692D424.2010908@gmail.com>
 <CAKws9z15+U6F+ywskEfxVqhmqgTWUrmXtZERuKsHjusE+SanyQ@mail.gmail.com>
To: PHP Internals <internals@lists.php.net>
Message-ID: <5692DDD0.8050900@gmail.com>
Date: Sun, 10 Jan 2016 22:40:16 +0000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
 Thunderbird/38.5.0
MIME-Version: 1.0
In-Reply-To: <CAKws9z15+U6F+ywskEfxVqhmqgTWUrmXtZERuKsHjusE+SanyQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC] Libsodium
From: rowan.collins@gmail.com (Rowan Collins)

Hi Scott,

On 10/01/2016 22:22, Scott Arciszewski wrote:
> And I'm of the opinion that most users need a library that does
> everything for them, and power users need a toolkit, and we shouldn't
> try to solve both use cases with the same library.

I don't think anyone is arguing against that, they just see a different 
pair of tools: a toolkit which is abstracted slightly away from 
libsodium but still has all its flexibility, and a crypto-for-dummies 
interface on top of that.


> If libsodium gets obsoleted (unlikely), it will be because of the
> availability of practical quantum computers, which also obsoletes
> openssl and all existing public-key cryptography. Mcrypt is unique in
> that it was completely abandoned (and poorly designed, to boot) after
> adoption. I don't think this is a meaningful discussion to have right
> now, given how widespread it is.

OpenSSL was incredibly widespread when Heartbleed was uncovered; it 
still is, and from your other mails you're still not a fan. Without a 
crystal ball, we can't know that Sodium is going to last forever, so are 
looking for a way to integrate its functionality into PHP in such a way 
that if an alternative comes along later, it is relatively easy to port 
code from one to the other, rather than tying PHP code directly to 
Sodium's API.

It may even turn out - I honestly don't know - that the only thing we 
need to change in Sodium's API is the word "Sodium", and we could simply 
present the functions as "a toolbox of encryption primitives, currently 
implemented using libsodium".

Regards,

-- 
Rowan Collins
[IMSoP]