Using Halite for Privacy and Two-Way Encryption of Emails

Cryptography is a complex matter. In fact, there is one golden rule:

* Don't implement cryptography yourself *

The reason for this is that so many things can go wrong while implementing it, the slightest error can generate a vulnerability and if you look away, your precious data can be read by someone else. Whilst this is not an exhaustive list, there are several important guidelines to follow when using cryptography:

• Don't use the same key to encrypt everything
• Don't use a generated key directly to encrypt
• When generating values that you don't want to be guessable, use a cryptographically secure pseudo random number generator (CSPRNG)
• Encrypt, then MAC (or the Cryptographic Doom Principle)
• Kerckhoffs's principle: A crypto system should be secure even if everything about the system, except the key, is public knowledge

Some of the cryptographic terms used in this article can be defined as follow:

• Key: a piece of information that determines the functional output of a cryptographic algorithm.
• CSPRNG: also known as a deterministic random bit generator, is an algorithm for generating a sequence of numbers whose properties approximate the properties of sequences of random numbers (or bytes). To be cryptographically secure, a PRNG must:
  • Pass statistical randomness tests
  • Hold up well under serious attack, even when part of their initial or running state becomes available to an attacker.
• MAC: is a short piece of information used to confirm that the message came from the stated sender (its authenticity) and has not been changed in transit (its integrity). It accepts as input a secret key and an arbitrary-length message to be authenticated, and outputs a MAC.

To further read about cryptography and have a better understanding, you can take a look at the following pages:

• NetAction's Guide to Using Encryption Software
• Introduction to Cryptography Basic Principles
• You Wouldn't Base64 a Password - Cryptography Decoded

Some libraries out there implement cryptography primitives and operations, and leave a lot of decisions to the developer. Examples of those are php's own crypto library, or Defuse's php-encryption. Some PHP frameworks implement their own crypto like Zend Framework's zend-crypt or Laravel.

Nevertheless, there is one library that stands out from the rest for its simplicity and takes a lot of responsibility from the developer on the best practices, in addition to using the libsodium library. In this article we are going to explore Halite.

Continue reading %Using Halite for Privacy and Two-Way Encryption of Emails%

by Miguel Ibarra Romero via SitePoint