4
$\begingroup$

I've recently had a situation in which a recommendation for an easy-to-use, hard-to-misuse cryptographic library for Java was required. The first choice was Google's Tink, since it was designed specifically for that purpose. Given it's association with Google, the customer was not too thrilled and asked for alternatives.

libhydrogen came to mind, which had a Java wrapper called Hydride, and was also designed to be easy-to-use and hard-to-misuse. However, libhydrogen only supports NORX v3.0 AEAD as the algorithm for secret-key encryption, which is based on Gimli permutations. Hashes and HMACs offered by libhydrogen are based on Gimli hash functions as well.

I have to admit, I've never heard of Gimli permutations, and I am not nearly skilled enough in cryptography to perform cryptoanalysis myself. As such, I hesitate to fully recommend libhydrogen as alternative to Tink. Can libhydrogen and its Gimli permutations be considered production-ready?

Improve this question
$\endgroup$
1
  • 1
    $\begingroup$ Not sure about libhydrogen's implementation of it, but the Gimli permutation is considered secure. $\endgroup$
    – forest
    Commented Feb 14, 2021 at 0:57

1 Answer 1

Reset to default
2
$\begingroup$

If you consider a feature being enabled by default as meaning the feature is production ready, then yes Gimli is production ready. However, it's still fairly new and hydrogen allows you to switch a compile time flag to use NORX/Keccak-p at the cost of being slightly slow.

Improve this answer
$\endgroup$
2
  • 2
    $\begingroup$ I'd consider "production-ready" to be "Cryptographers won't yell at you for using libhydrogen on an actual product". I hope that still holds true $\endgroup$
    – MechMK1
    Commented Jan 27, 2021 at 10:32
  • $\begingroup$ @MechMK1 I should have included this with the answer. github.com/jedisct1/libhydrogen/issues/10 $\endgroup$
    – Karan Veer
    Commented Jan 27, 2021 at 20:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.