Go NaCl and C NaCl/libsodium

[mike]

Does anyone have any sample code which shows interoperability between Go's golang.org/x/crypto/nacl/box and C's NaCl or libsodium? I have been having trouble boxing with Go and opening with NaCl (and vice versa). I have used NaCl from C a lot, but the Go NaCl packages are new to me. I am a little unclear as to whether the Go routines are compatible with crypto_box_open or libsodium's crypto_box_open_easy, for example.

--

Mike

 

:wq

[Ian Lance Taylor]

On Fri, Jul 12, 2019 at 9:28 PM mike <mi...@flyn.org> wrote:
>
> Does anyone have any sample code which shows interoperability between Go's golang.org/x/crypto/nacl/box and C's NaCl or libsodium? I have been having trouble boxing with Go and opening with NaCl (and vice versa). I have used NaCl from C a lot, but the Go NaCl packages are new to me. I am a little unclear as to whether the Go routines are compatible with crypto_box_open or libsodium's crypto_box_open_easy, for example.

I don't know the answer. I'm just replying to make sure that you know
that we are dropping NaCl support from Go after the 1.13 release.

Ian

[Dan Kortschak]

Different type of salt here. This is Networking and Cryptography
library, not Native Client.

[Manlio Perillo]

On Saturday, July 13, 2019 at 6:28:25 AM UTC+2, mike wrote:

Does anyone have any sample code which shows interoperability between Go's golang.org/x/crypto/nacl/box and C's NaCl or libsodium? I have been having trouble boxing with Go and opening with NaCl (and vice versa). I have used NaCl from C a lot, but the Go NaCl packages are new to me. I am a little unclear as to whether the Go routines are compatible with crypto_box_open or libsodium's crypto_box_open_easy, for example.

Go NaCl implementation *should* be compatible with NaCl.  I'm not sure about the compatibility between C NaCl and libsodium, you should check the source code.

If they are not compatible, it is probably a bug.

Writing sample code to check interoperability should not be hard.

Manlio Perillo

[B Carr]

Ugh. Why is that? What is the recommended replacement?

[Wojciech S. Czarnecki]

On Fri, 12 Jul 2019 20:49:58 -0700 (PDT)
mike <mi...@flyn.org> wrote:

> Does anyone have any sample code which shows interoperability between Go's
> golang.org/x/crypto/nacl/box and C's NaCl or libsodium? I have been having
> trouble boxing with Go and opening with NaCl (and vice versa).

> Mike

Once upon a time unknown three letter force of nature managed to change a
character in the reference NaCl source, and copies of this tampered source
persist on the net. Make sure you're not using this tampered one.
As per "x/crypto/nacl/box" declaration, it should be the direct equivalent of the [2].

As a result of discovered tampering the [3] reference implementation had been
produced and carefully inspected upon release. This is the version to be used
in vetting other implementations.

>>> On Friday, July 12, 2019 at 10:34:10 PM UTC-6, Ian Lance Taylor wrote:
>>> we are dropping NaCl support from Go after the 1.13 release.

>> On Sat, 13 Jul 2019 06:56:40 -0700 (PDT) B Carr <buc...@gmail.com> wrote:
>> Ugh. Why is that? What is the recommended replacement?

Names clash: for most Googlers and web developers NaCl stands for 'Native Client' [1].

For the crypto community NaCl[2][3] is a recognized name of Daniel J. Bernstein
NaCl library implementing his inventions (Curve25519 public key crypto
and Salsa family of ciphers). Famous D.J.Bernstein's "own build mode habits" effected
in the libsodium[4] - an open source "rich" version of the original NaCl reference code.
Libsodium follows build habits of the rest of the world.

>> Ugh. Why is that? What is the recommended replacement?

Now, was the question about [1] or [5]? :)

[1] https://en.wikipedia.org/wiki/Google_Native_Client
[2] https://nacl.cr.yp.to/
[3] https://tweetnacl.cr.yp.to/
[4] https://libsodium.org
[5] https://golang.org/x/crypto/nacl/box


Hope this helps,

--
Wojciech S. Czarnecki
<< ^oo^ >> OHIR-RIPE

[Ian Lance Taylor]

On Fri, Jul 12, 2019, 9:48 PM Dan Kortschak <d...@kortschak.io> wrote:

Different type of salt here. This is Networking and Cryptography
library, not Native Client.

Ah, sorry.

Ian

[B Carr]

Okay, I think I understand now. Ian intimates that support for "native client" is going away after Go v1.13. But support for the crypto/nacl package is remaining.

Have I got that right? Thanks for explaining.

[W. Michael Petullo]

After some experimentation, I found that the Go implementation is
indeed compatible with libsodium's "easy" API rather than DJB's original
NaCl API. I submitted an issue ticket requesting clarification in the
documentation:

https://github.com/golang/go/issues/33109

With some interest, I could probably write up a proposal and submit a
merge request. For now, my issue describes what I found, and it provides
example programs in Go and C.

--
Mike

:wq