Skip to content

Commit 816a989

Browse files
authored
Update STRANDLOCK_PROTOCOL.md
1 parent 96462fb commit 816a989

File tree

1 file changed

+23
-0
lines changed

1 file changed

+23
-0
lines changed

STRANDLOCK_PROTOCOL.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -428,14 +428,37 @@ The reason we use SHA3_512 specifically, and truncate to size we need, is actual
428428
-
429429

430430
**Question**
431+
431432
Why do you use `Argon2id` instead of `Argon2i` or `Argon2d` ?
432433

433434
**Answer**
435+
434436
Because `Argon2id` combines both `Argon2i` and `Argon2d` providing more general protection, and is recommended variant as per `RFC 9106`.
435437

436438

437439
**Question**
440+
438441
Why don't you use a NIST-approved algorithm instead of `Argon2id` ?
439442

440443
**Answer**
444+
441445
Because just because an algorithm is not NIST-approved, does not mean it's insecure. NIST tend to take their time standardizing and recommending algorithms, and `Argon2id` is relatively new. Even though `Argon2id` is on the newer side of things, it has won `Passowrd Hashing Competition` and has undergone many audits, and has been proven to be among the slowest, GPU-resistant hashing algorithms.
446+
447+
448+
**Question**
449+
450+
Why reinvent the wheel ? Why not adopt something like Signal's protocol ?
451+
452+
**Answer**
453+
454+
Even though Signal's protocol is well audited, and deployed widely, it offers bare minimum protection, with no overlapping layers, and no metadata protection. It works, it encrypts, it is safe against most "reasonable" adversaries.
455+
But it does not fit our criteria nor objective with the `Strandlock` protocol. Our threat model is much more paranoid than Signal's in multiple ways, that adopting their protocol would make no sense.
456+
457+
458+
**Question**
459+
460+
Why is the protocol name "Strandlock" ?
461+
462+
**Answer**
463+
464+
Because it combines cryptographic in a way that breaking one, two, or even three, does not break the entire protocol (or shall we say "strand"), sort of like a hair strand.

0 commit comments

Comments
 (0)