CryptKit 0.9: cryptsock

[Paul Rubin]

Bryan <bryan at eevolved.com> writes:
> When you say "shared secret key" do you mean that the remote and local hosts 
> both have apriori knowledge of the symmetric key? Or are you referring to  
> some other mutually shared token, like a password?  If you meant the latter, 
> then I agree with you completely and you should see that feature appear in 
> the next release :)

I mean a shared random symmetric key (i.e. something like 32 hex
digits), known a priori to both ends.  If it's a low entropy token
like a password, you need a fairly complicated protocol like SRP to
stop it from being found by dictionary attacks against recorded
traffic.  Including SRP (http://srp.stanford.edu) is a reasonable idea
though, since it's good for other things as well.