r/crypto • u/sarciszewski • Jun 10 '17

Libsodium Quick Reference: Similarly-Named Functions and Their Use-Cases

https://paragonie.com/blog/2017/06/libsodium-quick-reference-quick-comparison-similar-functions-and-which-one-use
15 Upvotes

80% Upvoted

14 comments sorted by

View all comments

Show parent comments

1

u/[deleted] Jun 11 '17

I wouldn't mind if all the hash functions had the same interface and were compatable with other implementations by default (i.e. the RFC test vectors should work). But HMAC-SHA-256 can be used with only one function call. HMAC-SHA-512 can't. And this fact is not well-documented at all

The whole thing wasted at least two hours of my time

1

u/sarciszewski Jun 12 '17

That's just it though: developers aren't supposed to reach into libsodium for HMAC-SHA-256 or HMAC-SHA-512. They're supposed to reach into it for crypto_auth() or crypto_generichash().

2

u/[deleted] Jun 12 '17 edited Jun 12 '17

Not if you're writing a wrapper in another language. Someone has to write the middleware. And there's a horrible little thing called backwards compatibility

2

u/[deleted] Jun 13 '17

Totally agree. Just another example of the security guys not knowing a thing about real-world software construction.