from the Security Cryptography Whatever podcast, talking about openssl API design choices: https://youtu.be/jhdLja5mWbU
YouTube
Obviously you have to do a string compare to do AES GCM in OpenSSL 3
Jann Horn
@jann@infosec.exchange
human borrow checker (but logic bugs are best bugs).
works at Google Project Zero.
The density of logic bugs (compared to memory corruption bugs) goes down as the privilege differential between attacker context and target context goes up.
November 18, 2022
Replying to
posteo does have a thing where incoming email is cryptographically protected when being stored to disk, in a way that ties back to the user's password; https://posteo.de/en/site/encryption#cryptomailstorage documents this and Posteo's interpretation of what they can be compelled to do under german law.
Of course, something more comprehensive that also protects mail in transport would require protocol changes...
posteo.de
Email green, secure, simple and ad-free - posteo.de - EncryptionPosteo is an innovative email provider that is concerned with sustainability and privacy and is completely ad-free. Our email accounts, calendars and address books can be synchronised - we use comprehensive encryption.
