Hacker News new | ask | show | jobs
by 0x0 4225 days ago
I'm curious about NaCl, would it be possible to replace OpenSSL with something based on this library? If not, why not?

The feature list certainly looks impressive!
2 comments
sdevlin 4225 days ago
It depends on your use case.

If you need something that speaks TLS, then no. NaCl is a different (simpler) protocol that does not have TLS compatibility as a goal.

If you're building a new application then NaCl is probably a good choice. There are some problems you may need to solve yourself, if your application calls for them. For example, NaCl has no notion of a CA hierarchy.

link
feld 4225 days ago
Lack of a CA hierarchy sounds like a problem has just been solved for you
link
sdevlin 4225 days ago
Yeah, it's arguably a plus.
link
edwintorok 4225 days ago
If you have to interoperate with something already using OpenSSL then probably not.

If you are writing a new application then read on.

There are 2 NaCl alternatives to consider as well: Sodium (API compatible) [2], TweetNaCl (small, auditable) [1].

There are higher-level protocols that uses NaCl, CurveCP [3] for UDP, and CurveZMQ for TCP[4], although "CurveCP software isn't ready for users yet".

[1] http://tweetnacl.cr.yp.to/ [2] http://doc.libsodium.org/

[3] http://curvezmq.org/page:read-the-docs [4] http://curvecp.org/

link