Exploring Cryptographic Implementations in OpenZiti for Enhancing Security

Ziti Overlay
1

Hi everyone,

I'm delving into the cryptographic aspects of OpenZiti. I'm interested in understanding the current cryptographic implementations within OpenZiti.

Could anyone share insights or direct me to resources on the following:

Current Cryptographic Framework: What cryptographic methods does OpenZiti currently employ? How are these methods integrated within the system?

Cryptographic Modules: Could someone point me to the files or modules within the OpenZiti codebase that are primarily responsible for implementing cryptographic functions? I am interested in both the encryption/decryption mechanisms and how cryptographic keys are managed.

Thank you for your time and assistance!

2

OpenZiti has end to end encryption provided by "lib sodium". see: Key Concepts | OpenZiti
and Connection Security | OpenZiti

libsodium uses ChaCha20-Poly1305 - ChaCha20-Poly1305 - Libsodium documentation

It's in a myriad of SDKs. I'd start by looking at the c sdk, the go sdk, etc.

OpenZiti also support mutual TLS between nodes so it's not just the end to end encryption that's useful to understand, you'll also want to look at the code for how links form between routers as well as how SDKs attach to edge routers.

hth

1 Like