Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

It seems like one can generate keys and encrypt data with both libraries. Is one better than the other? Do they attempt to solve different problems? Is one more secure than the other?

share|improve this question

closed as off-topic by e-sushi, Gilles, Seth, rath, mikeazo Sep 17 '13 at 14:53

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

I asked one of my friends who works for a security company and this is what he said:

PyNaCl and PyCrypto are generally meant for different audiences. PyCrypto is not as easy to use. As you've experienced, you have to choose the encryption algorithm, the block cipher mode, and provide your own padding scheme. You have many options when using PyCrypto, which is good for learning, but very bad if you are trying to write real apps and you're not an expert in cryptography.

NaCl, on the other hand, takes away options, instead providing secure defaults. You can encrypt and decrypt whatever you like, just like with PyCrypto, but it abstracts away the fine details. You don't have to worry about things like authenticating ciphertexts, writing a padding scheme, choosing a secure block cipher mode, etc. It is designed to make it hard for developers to screw up when using it, so it is a great choice.

That said, it's still possible to mess things up when using NaCl. For instance, you still have to provide a nonce every time you encrypt something. If the same nonce if ever used to encrypt more than one plaintext, then it becomes trivial to decrypt the ciphertext (because NaCl uses a stream cipher). There are also a bunch of other subtle issues that could arise, so you should still get your code audited before declaring it fit for use.

share|improve this answer
What subtle issues ? are they written anywhere ? –  hulkingtickets Aug 18 '14 at 10:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.