undefined | Better HN

0 pointstheandrewbailey9y ago0 comments

JDK 10 will have TLS Fallback SCSV and native ChaCha20 support, though I wish they were in JDK 9.

0 comments

3 comments · 1 top-level

samch9y ago· 2 in thread

Not sure why you have to wait. I use ChaCha in production in JDK 8: https://github.com/bcgit/bc-java/blob/master/core/src/main/j...

Why would native be any better? I would think that as long as the implementation matches the reference it wouldn't matter.

theandrewbaileyOP9y ago

Last weekend, I added Bouncy Castle as the security provider in my dev environment, but my server did not show ChaCha20 in the list of available TLS ciphers. I was not convinced that my server was even using BC. Knowing that if you don't know what you're doing and mess around with crypto too much that you can get burned, I gave up. ECDHE RSA AES GCM for now.

samch9y ago

I think I see where you're coming on that. For most of my applications, I terminate TLS connections with nginx. I do use ChaCha for high-speed encryption in other areas, though. The BC libraries have always worked great for me.

j / k navigate · click thread line to collapse