4 ms·

I'm a contributor to OpenPGP.js. I understand your choice as the code was indeed in quite bad shape several months ago. I do want to point out though, that the

by tanx 12y ago

I'm a contributor to OpenPGP.js. I understand your choice as the code was indeed in quite bad shape several months ago. I do want to point out though, that the code has gone through a big refactoring an cleanup since then: https://github.com/openpgpjs/openpgpjs/releases https://github.com/openpgpjs/openpgpjs/releases We also fixed all critical, high and medium issue: https://github.com/openpgpjs/openpgpjs/wiki/Cure53-security-audit https://github.com/openpgpjs/openpgpjs/wiki/Cure53-security-... Having said that, a consistent rewrite using typed array and native web crypto apis under the hood does indeed sound very reasonable. I saw that native web crypto is not used throughout. What are your plans in regards to web crypto? Also what is the predicted timeline for getting End-to-End into a production ready state? We would be quite interested in using it as a standalone library in our Chrome Packaged App: https://whiteout.io https://whiteout.io Thanks

cryptbe 12y ago
Thanks for the update on OpenPGP.js. > What are your plans in regards to web crypto? The plan is to use WebCrypto if it's available. We've moved RSA to WebCrypto, and the next targets are ECDH and ECDSA. > Also what is the predicted timeline for getting End-to-End into a production ready state? We would be quite interested in using it as a standalone library in our Chrome Packaged App: https://whiteout.io https://whiteout.io I can't tell you about our timeline for the extension. But if you just want to use the crypto library, you may want to wait for a couple of weeks, just to make sure none discovers any serious vulnerabilities. I like WhiteOut. It's a great product in the right direction. We really want and will support the usage of the library in products like yours.
- tanx 12y ago
  Thanks for for reply. I'm wondering if you know if it's possible to use the AES-CFB mode from the Web Crypto Apis, since the OpenPGP CFB (resync) mode seems to have special requirements? > I like WhiteOut. It's a great product in the right direction. We really want and will support the usage of the library in products like yours. Thanks! Is there a guide somewhere that explains how to build the standalone lib?
  - cryptbe 12y ago
    > Thanks for for reply. I'm wondering if you know if it's possible to use the AES-CFB mode from the Web Crypto Apis, since the OpenPGP CFB (resync) mode seems to have special requirements? I haven't looked into it. > Thanks! Is there a guide somewhere that explains how to build the standalone lib? No, there isn't. But can you file a bug with us? I'll make sure we have something for you. PS: how can I contact you?
    - tanx 12y ago
      My email is tankred@whiteout.io

by tanx 12y ago

cryptbe 12y ago

Thanks for the update on OpenPGP.js. > What are your plans in regards to web crypto? The plan is to use WebCrypto if it's available. We've moved RSA to WebCrypto, and the next targets are ECDH and ECDSA. > Also what is the predicted timeline for getting End-to-End into a production ready state? We would be quite interested in using it as a standalone library in our Chrome Packaged App: https://whiteout.io https://whiteout.io I can't tell you about our timeline for the extension. But if you just want to use the crypto library, you may want to wait for a couple of weeks, just to make sure none discovers any serious vulnerabilities. I like WhiteOut. It's a great product in the right direction. We really want and will support the usage of the library in products like yours.

tanx 12y ago
Thanks for for reply. I'm wondering if you know if it's possible to use the AES-CFB mode from the Web Crypto Apis, since the OpenPGP CFB (resync) mode seems to have special requirements? > I like WhiteOut. It's a great product in the right direction. We really want and will support the usage of the library in products like yours. Thanks! Is there a guide somewhere that explains how to build the standalone lib?
- cryptbe 12y ago
  > Thanks for for reply. I'm wondering if you know if it's possible to use the AES-CFB mode from the Web Crypto Apis, since the OpenPGP CFB (resync) mode seems to have special requirements? I haven't looked into it. > Thanks! Is there a guide somewhere that explains how to build the standalone lib? No, there isn't. But can you file a bug with us? I'll make sure we have something for you. PS: how can I contact you?
  - tanx 12y ago
    My email is tankred@whiteout.io