What's new in Go's cryptography libraries: Part 2 (Go Time #298)
Dec 12, 2023
auto_awesome
Filippo Valsorda, Roland Shoemaker, and Nicola Murino from the Go Team are back to catch us up on what's new in Go's crypto libraries. They discuss transitioning from pre-quantum to post-quantum cryptography, the performance impact of Chateree on common operations, implementing a new extension to the OpenSSH protocol, challenges in the SSH world, their unpopular opinions, and even their cooking abilities and kitchen setups.
Transitioning to post-quantum cryptography to protect against quantum computer attacks is a priority for Go's cryptography libraries.
Implementing new SSH security features, such as the 'ping' protocol extension, presents challenges in maintaining backward compatibility and addressing algorithm negotiation complexities.
Switching to Chacha8 as the default number generator in Go 1.22 enhances cryptographic safety and prevents potential coding mistakes with math rand.
Deep dives
Moving from pre-quantum to post-quantum cryptography
The podcast episode discusses the need to transition from pre-quantum to post-quantum cryptography as quantum computers could potentially break current cryptographic methods. The episode mentions the NIST competition where various proposals were submitted and a selection process resulted in the choice of key exchange and signature algorithms. The selected algorithms aim to provide security against potential quantum computer attacks. The episode also highlights the challenge of the larger sizes of keys and signatures in post-quantum algorithms, which could impact performance and compatibility.
Improved support for SSH security
The podcast episode covers recent updates and improvements in SSH security. It mentions the implementation of a new protocol extension called ping at openSSH.com, version 0, that helps conceal keystrokes to prevent passive network detection. The discussion includes the challenges faced in implementing this feature due to limitations in the existing SSH package and the need for a multi-aggregate cipher interface. The episode also highlights the effort and collaboration involved in maintaining the SSH library, ensuring backward compatibility, and addressing issues such as SHA-1 support and algorithm negotiation complexities.
Default number generator change in Go 1.22
Towards the end of the episode, it is mentioned that the default number generator in Go 1.22 is switching to Chacha8 for math rand, ensuring cryptographic safety by default. This change aims to prevent potential coding mistakes where math rand might be used instead of crypto rand. The episode emphasizes the importance of this change in avoiding security vulnerabilities and references a previous episode for more details on the topic.
Quick: The Next Version of HTTP
Quick is often referred to as the next version of HTTP. It serves as the underlying transport protocol of HTTP/3, bringing new semantics and support for the next generation of internet connections. Unlike its predecessor, quick encrypts headers to prevent network engineers from modifying them. While it may not directly impact web crawlers, it disrupts middle boxes that interfere with network traffic. The integration of quick and Go is made possible by running a TLS handshake over quick and extracting the necessary components for transport. Thus, ensuring a more efficient and secure communication protocol.
Improving TLS Certificate Parsing
A significant improvement has been made in parsing X.509 certificates in TLS. The introduction of a new library called CryptoByte in Go has allowed for explicit parsing that significantly speeds up the process. By replacing the previous reflection-based implementation, parsing certificates has become 80% faster. This advancement ensures better compatibility and efficiency for users of cryptographic protocols like SSH. Not only does it streamline FIPS configurations, but it also paves the way for improved tests that validate interoperability between the Go implementation and OpenSSH.
Filippo Valsorda & Roland Shoemaker from the Go Team return & bring Nicola Murino with them to continue catching us up on what’s new in Go’s crypto libraries.
This is everything we didn’t cover + deep dives from Part 1!
Fastly – Our bandwidth partner. Fastly powers fast, secure, and scalable digital experiences. Move beyond your content delivery network to their powerful edge cloud platform. Learn more at fastly.com
Fly.io – The home of Changelog.com — Deploy your apps and databases close to your users. In minutes you can run your Ruby, Go, Node, Deno, Python, or Elixir app (and databases!) all over the world. No ops required. Learn more at fly.io/changelog and check out the speedrun in their docs.