Top all-time · #6705
Brian Smith
Personal blog · briansmith.orgsecurityprogramming
Brian Smith's personal blog at briansmith.org covers security and programming. Since 2013, 11 different Hacker News readers have linked it 14 times, most often “Ideas for a New Elliptic Curve Library”. The last post was in 2023, but the archive is still widely read.
Too few sampled comments (5) to say how often HN recommends it.?
Why HN links it
HN readers cite Brian Smith's posts on TLS cipher suite choices, the 2014 Camellia removal and curve selection as background on web crypto, and link his webpki library docs.
Summarised by Claude from a sample of 5 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Ideas for a New Elliptic Curve Library2 people · 2 mentions · first linked 2015-10-20
- Proposal to Change the Default TLS ciphersuites Offered by Browsers2 people · 2 mentions · first linked 2013-08-09
- Why Not Rust Crypto?2 people · 2 mentions · first linked 2023-09-26
What Hacker News says?
It is interesting to see that Google decided to opt for NIST P-384 curve for the root certs it is going to have valid until 2036. Brian Smith has argued for supporting only P-256, P-384 and Curve25519: https://briansmith.org/GFp-0 . That said, Mozilla decided to continue to advertize support for P-521 for NSS ( https://bugzilla.mozilla.org/show_bug.cgi?id=1128792 ). P-256 and P-384 are widely supported in various TL…
Comment linking /GFp-0
on “The foundation of a more secure web: Google Trust Services”Submitted Proposal to Change the Default TLS Ciphersuites Offered by Browsers as a story · 132 points
HN discussionTo add to my point, once a few key parties chose Bernstein's crypto, network effects did most of the rest. Adam Langley [1] of Google authored the very first draft [2] of ChaCha20 and Poly1305 in TLS in September 2013 and started the feature request in Mozilla NSS that same month [3], while it presumably shipped in Chromium and BoringSSL earlier. A 2014 Google blog post credits the Poly1305 implementation to Andrew…
Comment linking /browser-ciphersuites-01
on “On the Impending Crypto Monoculture (2016)”Submitted Ideas for a New Elliptic Curve Library as a story · 68 points
HN discussionThere's a JIT framework in Rust: https://github.com/bytecodealliance/wasmtime There's a library for doing full X.509 certificate parsing and verification: https://briansmith.org/rustdoc/webpki/ There's definitely some attempts at doing pure-Rust SSL, but I suspect a lot of them are also doing some sketchy things with crypto that shouldn't be trusted (getting constant-time stuff implemented properly is really challen…
Comment linking /rustdoc/webpki/
on “What Is Rust's Hole Purpose?”Submitted Let's Build a FIPS-Validated Rust Crypto Library as a story · 8 points
HN discussionPlease add the changes that resulted from Brian Smith's (of Mozilla) blog post 'Proposal to Change the Default TLS Ciphersuites Offered by Browsers' [1] -- the post dates to August 2013. This was a very impactful proposal that changed the way browsers preferred ciphersuites. But it also removed some lesser-used ciphersuites based off of telemetry [2], including the block cipher Camellia, which was the only other mod…
Comment linking /browser-ciphersuites-01
on “SSL/TLS and PKI History”Submitted Proposal to Change the Default TLS ciphersuites Offered by Browsers as a story · 3 points
HN discussionSome background: In 2014, Mozilla disabled support for all TLS ciphersuites using the block cipher Camellia [1] after this blog post [2]. That blog post that discussed on HN at the time [3]. In light of the latest round of TLS attacks (SWEET32) [4], 3DES -- an old block cipher occasionally kept in use for compatibility with very old systems -- will likely be deprecated for good. This will leave mainstream browsers w…
Comment linking /browser-ciphersuites-01
on “Remove Camellia ciphersuites (2014)”Submitted Why Not Rust Crypto? as a story · 2 points
HN discussionSubmitted Proposal to Change the Default TLS Ciphersuites Offered by Browsers as a story · 2 points
HN discussionSubmitted Why Not Rust Crypto? as a story · 1 points
HN discussionSubmitted Rust Cryptography Should Be Written in Rust as a story · 1 points
HN discussionSubmitted Improving the Web Platform’s Referrer Policy as a story · 1 points
HN discussion
