I’d like to secure communication in my cluster via TLS using Curve25519 certificates. Please hear me out why that is, you might be surprised.
For TLS, the choice is between legacy RSA certificates, and elliptic curve cryptography. I don’t want to use RSA, because of it’s inferior attributes, and because there are some concerns that it may be broken in the foreseeable future. Rather, I want to use the modern, more secure and more efficient elliptic curve cryptography. Java natively supports the NIST curves P-256 and P-384 for this, which is also supported by browsers. So why am I not using them?
The NIST curves are developed by the NSA and have unexplained seed parameters, which the NSA is unwilling to explain, similar to the backdoor that they inserted into Dual_EC_DRBG to compromise SSL security. Many experts have raised concerns, and it just doesn’t feel right to use encryption coming from someone with such track record of trying to backdoor security - yes folks, you should know this. From the Wikipedia article
The NSA encourages the manufacturers of security technology to disclose backdoors to their products or encryption keys so that they may access the encrypted data.[9] However, fearing widespread adoption of encryption, the NSA set out to stealthily influence and weaken encryption standards and obtain master keys—either by agreement, by force of law, or by computer network exploitation (hacking).
So nah, I’m not going to use any of the NSA stuff, i.e. NIST curves.
The best alternative is Curve25519, which has also wide support (e.g. Chrome/Firefox) but only made it into Java 13. Curve25519 has superior attributes to the NIST curves, highly researched and reviewed, not NSA, and is guaranteed to be backdoor-free, with the Nothing-up-my-sleeve principle, and won’t be broken anytime soon.
I know this might not be a trivial request, but I’d like to know if there is a way to configure Akka to use a security provider such as bouncy-castle to make the use of Curve25519 (i.e. ed25519) possible in Akka. I don’t have much experience with the same.