X25519Kyber768 key encapsulation for TLS

date: 2024-04-30 · Tags: #news, #cryptography

Starting in Chrome 124, Chrome enables by default on all desktop platforms a new post-quantum secure TLS key encapsulation mechanism X25519Kyber768, based on a NIST standard (ML-KEM). 1

Major browsers are starting to deliver post-quantum secure key exchange mechanisms. Though the quantum threat is still far away, it's still essential to migrate tls key agreements to prevent "store-and-decrypt" attack, which could be able to decrypt stored traffic until a quantum computer is available in the future.

But on the other side, the launch of Google Chrome 124 and Microsoft Edge 124 were appearently breaking TLS connections to some legacy web applications, firewalls, and server products. Adoption of the new key exchange mechanism is a long way to go.

Cloudflare have also made lots of effort to make the post-quantum cryptography available to the public. They have tried to secure the connection from Cloudflare to origin servers in production from 2023 2. Besides, there is a tool tldr.fail to help developer to show error info with ClientHello messages during tls connection.

Other related posts:

Footnotes

  1. Feature: X25519Kyber768 key encapsulation for TLS

  2. Cloudflare now uses post-quantum cryptography to talk to your origin server

Lean Scala (from Martin Odersky)

date: 2024-04-12 · Tags: #dev, #scala

Last year, I post a snippet for a thread discussed about current scala situation. And after multiple releases and pretty good progressive adaption of scala 3, Martin Odersky, the creator of Scala, declares his thoughts1 about the future of Scala. Although if you're active in the Scala community, Martin has been talking about this for a while, it's still worth to follow/read. It's more like a formal manifesto.

What is Lean Scala? Here are some key points:

  • It should follow the Principle of Least Power.
    • Try to use the least powerful features first, only introduce black magic tricks when they are really needed.
  • It should be immutable first, without being dogmatic about it.
    • As it says, prefer immutable data and pure functions, allow effects which are well contained and described. Scala team also plans to introduce Capturing Types to help with this.
  • It should promote the core language over embedded DSLs.
    • Distinguish Lean Scala from "Scala as a host language for DSLs".
  • It should focus on direct style.
    • Follow the last principle, Lean Scala should be direct and explicit. And
    • Monadic effect systems shine in some areas but they are also a kind of DSL, which creates specialized eco-systems and dialects.

Lean Scala looks like a good direction for Scala, especially for the new users outside from FP world. Easy to learn, easy to use, easy to maintain would make a language live longer 🥹 and be adapted by more real cases.

Then how could we promote Lean Scala? Martin suggests: 1. Write technical documentation; 2. Work on tooling support; 3. Encourage efforts to assemble and promote library stacks. Every language won't be prosperous without its community and eco-system.

For me, I'm still a fan of Scala, and I'm glad to see the progress of Scala 3 which I thought is really underrated.

Footnotes

  1. Lean Scala