Re: [Cfrg] When TLS is an overkill...

[[e-mail]]

Sounds like goal is quite similar to what noise protocol framework tries to achieve. 

On 26 February 2019 08:45:45 GMT, Ruslan Kiyanchuk <[e-mail]> wrote:
>> What I am trying to do is quite simple: /provide a building block
>that
>> developers and engineers can use to secure the communication between
>> two peers by using a low number of messages/.
>>
>> In particular, I think that this building block could help many
>> developers to do the right thing when not using TLS. Do not get me
>> wrong, TLS is great.. however, it might be useful to have an
>> alternative. My particular use case (but this is just one, there
>might
>> be many others) is specifically EAP. In EAP, it seems, people always
>> try to re-use
>>
>I think you might be trying to reinvent Noise protocol framework
><http://www.noiseprotocol.org/> :)
>
>It's a framework designed to be simple and straightforward for for
>securing 2-party communication. By combining different elements of the
>protocol you achieve various security properties. There is also a third
>party website Noise Explorer <https://noiseexplorer.com/> where you can
>explore various settings of the framework and corresponding security
>properties.
>
>By your description so far it sounded like a good fit.
>
>Another mention that may be relevant is Google's ATLS
><https://cloud.google.com/security/encryption-in-transit/application-layer-transport-security/>
>(it's their home-grown TLS alternative, I'm not aware how much scrutiny
>and analysis it underwent).
>
>Good luck!