2. whoami
Evan Johnson.
Work at CloudFlare on all things security.
Wrote `passgo` (https://github.com/ejcx/passgo).
gopher of 1.5 years.
3. Writing Crypto Is Inevitable
Requirements handed down on stone tablets.
Engineers have ideas for their own products.
Engineers who don’t know cryptography consistently get a
couple things wrong.
5. The Go Crypto Package
Lots and lots of subpackages.
Not super super useful unless you know crypto.
AES, DES, MD5, RC4, RSA, SHA1, Elliptic, Rand, TLS, x509,
HMAC, ECDSA, DSA, and “cipher”
Cryptographers Recommend “Authenticated Encryption”
12. What else to know
x/crypto/scrypt - Key Derivation Function. If you have a
“secret string”, turn it in to a true “key” here.
crypto/rand NEVER math/rand
Ask for help before releasing if you have questions.
You have no reason to be writing the letters “AES” in your
code.
Editor's Notes
These are my notes.
heyooooo!
You use cryptography every day. TLS/HTTPS stuff. Since we are gophers, The gorilla sessions are backed by their “securecookie” package which is all crypto.
A lot of cryptographers argue that regular devs should not be writing crypto code. “Don’t roll out your own” is commonly said. Many people, this and theymean don’t build your own crypto algorithms and practices, but many people also mean “stay away, you shouldn't be writing crypto code if you don’t understand it.”
This is “abstinence only cryptography” and I don’t believe it’s the best way to do things.
At least I think so. It’s about making simple easy.
I’m a big fan of how Go has made changes to the “normal” way things are done.
The first big change I noticed was the Flag package instead of getopt. Getopt is awful. Flag is pretty usable. Parse flags quickly and easily and simple. It took ~1000 lines of code in the standard packages to make this happen.
“The Go Way” in the title of my talk is about simplicity.
Go has a really robust standard library for crypto. Friendly docs and memory safe.
Not good for beginners
Golang developers tried to avoid foot shooting with the crypto package.
Huge step up from openssl libraries or mcrypt in php or whatever
How do you go from “recommendation” to real code in the go crypto package.
First result for “golang encrypt” Stackoverflow recommends AES CiphertestFeedBack mode with a static key.
Great for stackoverflow, not great security advice because stackoverflow lacks context and in security, context is everything
AEAD
An abstraction that removes primitives out of your crypto choice. It is all about secure defaults and simple interfaces
This is why I mention go is about simplicity. AEAD’s have a very simple interface.
Use NaCl (Salt). This is all DJB approved crypto. If you don’t know who DJB is you should he’s the greatest
Open and Seal are the two staples of the AEAD interface.
This is easier code to write!
No crazy interfaces
Easier to understand. Encrypt. Decrypt. All bytes and no magic interfaces
