Comments URL: https://news.ycombinator.com/item?id=46518761

Points: 10

# Comments: 1

Getting ready to release a 1.0.0 of sanctum [1], after almost a year of internal testing, dogfooding and talking about it at security conferences.

We've also setup conclave [2] as an official release site for the projects tied to sanctum such as tier6, or the library implementation of the protocol etc.

[0] https://github.com/jorisvink/tier6

[1] https://sanctorum.se

[2] https://conclave.se

Comments URL: https://news.ycombinator.com/item?id=46191550

Points: 2

# Comments: 0

I am always looking for more people to test and play with it or even review the code. We've got a nice little user community going.

Usually this comments drowns in the crowd of the massive amount of awesome stuff people are building, but if you find sanctum useful, hit me up. Good things are happening.

Stay happy

[1] https://sanctorum.se

Soon approaching a 1.0 release for sanctum once I get my brain out of vacation mode and into hacking mode again. A lot has happened this year and I am excited.

I will be talking about how sanctum and its cathedrals work at sec-t 2025 [2] so in full swing working on the demos and presentation.

[0] https://github.com/jorisvink/sanctum

[1] https://reliquary.se

[2] https://sec-t.org

There's reliquary [2] which I host and run for me and my hacker friends based on sanctum.

[1] https://github.com/jorisvink/sanctum

[2] https://reliquary.se

Comments URL: https://news.ycombinator.com/item?id=43868890

Points: 28

# Comments: 4

It is shaping up nicely towards an actual 1.0 release in the near future, with a little less keccak based AEADs this time around. It was a fun experiment but in the end I have yet to do any cryptanalysis on it or provide security proofs for it - neither which I have time for at this point - so the swap to AES was expected on my end.

For fun I also added a fully e2e p2p voice chat client on top of this as the sanctum protocol is now available as a library (https://github.com/jorisvink/libkyrka) - this voice chat works with one or multiple peers and can is available at https://github.com/jorisvink/confessions.

Either way, I guess you can say I'm having a little bit too much fun with this.

I would like to announce the soft availability of The Reliquary [0]: A "VPN" service for hackers.

Note that VPN is in air quotes here because it is not a traditional consumer VPN your strange uncle uses to watch questionable online content.

With Reliquary you can setup end-to-end encrypted, peer-to-peer tunnels between your devices no matter where they are located.

The Reliquary was started after I built sanctum [1] to make it a bit easier to setup networks and tunnels between me and my hacker friends.

I ended up building a simple management API around sanctum and its cathedral mode that allows you to define networks and join devices into these networks, all the while keeping the shared secrets sanctum builds its security on completely in your hands while still providing meaningful ways of doing key rotations.

On your client devices you use some shell scripts reliquary provides to manage sanctum configurations, there's zero magic.

A cathedral in sanctum acts as a discovery point (think STUN) for your devices and can relay (but not read/alter) encrypted traffic when needed. They also facilitate key rollover by acting as a distribution point for your shared secrets (which are wrapped with per-device KEKs).

If your devices are behind reasonable NAT, they will move towards a peer-to-peer connection, leaving the cathedral behind.

Keep in mind that The Reliquary is directly aimed at the hacker crowd as one should be familiar with certain topics to be able to feel comfortable with it (you need to handle your own key management, network setup, etc).

A starting guide can be found at [2] for those who are interested.

I built this to be useful to me and my hacker friends, I hope some of you might find it equally useful - I am happy to answer some questions but I dislike writing on public forums (digital agoraphobia?)

You can get in touch with me via joris@sanctorum.se

Take care,

[0] https://reliquary.se [1] https://sanctorum.se/sanctum/ [2] https://reliquary.se/guide.html

Comments URL: https://news.ycombinator.com/item?id=42621476

Points: 3

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=40197632

Points: 3

# Comments: 0

Not actively. It has been in hybernation for a long time.

Not counting the recently-ish fixes I committed not much is happening with it.

You're not forced to use the CLI create/build/run commands for anything. They just make it easier, but you are in no way tied to this.

Building the module itself can be done on your own for example, as it is just a normal dynamic library you can use whatever build system you want.

I've considered time and time again to turn kore into a "library" that you can link against and include into your own applications but every time I decided against it as it didn't give me any real benefits. It would make certain things considerable harder, who takes care of the worker processes? Who takes care of the logging and the internal message relaying? Having this abstracted away in a library is probably possible but adds tons of expectations on your own application.

Having Kore as the platform your code runs under makes this easier.

Thanks for explaining however, very insightful!

What fears? Care to elaborate? I'd love to hear!

I strongly dislike declaring variables anywhere else but the function root, but I agree with you on the example you provided that those kind of variables could be constified to be sane.

I see you picked out the few things that I consistently hear on the coding style I adopted which is based on my time hacking on openbsd. I have no real points to argue against those as it is based on preference in my opinion.

I am curious why you arrived on it not being sufficiently constified however. I'll gladly make sensible changes.

As for the multiple fprintf() calls ... to me it just reads better and the place it occurs in is as you stated pretty obvious non performance critical.

I agree the BENCHMARK build option is a bit confusing. I might end up renaming it altogether.