Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Sure, but we can't encourage it's use until people can get access to server software that includes it, and openssl - and everything that links to libssl - doesn't right now.


Cloudflare implements Chacha20/Poly1305 using OpenSSL, and published their patches.


I know, that's why I linked to those patches in the article, then subsequently mentioned their existence in another response to you three hours before you wrote the above.

That doesn't change that people won't use it until it's in openssl properly and they don't have to maintain a patched version themselves.


I don't understand why a sober assessment of people's SSL implementations should account for stuff like this.

There are two options: enable the only modern native stream cipher available for TLS, and with it the only polynomial MAC that doesn't require hardware support (and thus the best polynomial MAC available for mobile devices), or don't.

The former option is superior to the latter option. The latter option is easier, but: nobody said engineering was supposed to be easy.

Either SSL Labs is evaluating the quality of TLS implementations, or they're evaluating something else. Arguments like the ones I see on this thread suggest it's "something else".


Encourage people to use a library that includes chacha20...


That's pretty reasonable, if libre or boring started using it (especially since they both have other advantages over open).




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: