Security audit(s)

[daviddahl]

I am unaware of any security audits that may have already been performed on libp2p-crypto and its underlying primitive dependencies. node-forge needs a security audit ( digitalbazaar/forge#103 ) - which would help this project. I suggested to them to look into the open source crypto auditing that has helped other projects, see:

https://opencryptoaudit.org/
https://wiki.mozilla.org/MOSS/Secure_Open_Source

FWIW, while audits are not perfect, I managed a crypto project that was audited a few times, and we found several holes to plug.

[theogravity]

Agreed, we're hesitant to use the library due to the lack of an audit. Our security team is recommending to use openssl directly instead where possible.

[jacobheun]

We'll look at getting this on the roadmap in the near future. We are planning to do an overhaul soon to improve compatibility and usability. It would be good to work on coordinating an audit as part of this.