# Exploring Cryptographic Implementations in OpenZiti for Enhancing Security

**URL:** <https://openziti.discourse.group/t/exploring-cryptographic-implementations-in-openziti-for-enhancing-security/2094>\
**Category:** Ziti Overlay\
**Created:** [February 18, 2024, 4:02pm UTC](https://openziti.discourse.group/t/exploring-cryptographic-implementations-in-openziti-for-enhancing-security/2094 "2024-02-18T16:02:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nise](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/nise/32/1756_2.png) [@nise](https://openziti.discourse.group/u/nise)\
**Post date:** [February 18, 2024, 4:02pm UTC](https://openziti.discourse.group/t/exploring-cryptographic-implementations-in-openziti-for-enhancing-security/2094/1 "2024-02-18T16:02:09Z")

</div>

Hi everyone,

I'm delving into the cryptographic aspects of OpenZiti. I'm interested in understanding the current cryptographic implementations within OpenZiti.

Could anyone share insights or direct me to resources on the following:

Current Cryptographic Framework: What cryptographic methods does OpenZiti currently employ? How are these methods integrated within the system?

Cryptographic Modules: Could someone point me to the files or modules within the OpenZiti codebase that are primarily responsible for implementing cryptographic functions? I am interested in both the encryption/decryption mechanisms and how cryptographic keys are managed.

Thank you for your time and assistance!

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [February 18, 2024, 4:07pm UTC](https://openziti.discourse.group/t/exploring-cryptographic-implementations-in-openziti-for-enhancing-security/2094/2 "2024-02-18T16:07:49Z")

</div>

> [@nise](#):
>
> Current Cryptographic Framework: What cryptographic methods does OpenZiti currently employ? How are these methods integrated within the system?

OpenZiti has end to end encryption provided by "lib sodium". see: [Key Concepts | OpenZiti](https://openziti.io/docs/learn/introduction/key_concepts/#end-to-end-encryption)  
and [Connection Security | OpenZiti](https://openziti.io/docs/learn/core-concepts/security/connection-security)

libsodium uses ChaCha20-Poly1305 - [ChaCha20-Poly1305 - Libsodium documentation](https://libsodium.gitbook.io/doc/secret-key_cryptography/aead/chacha20-poly1305)

> [@nise](#):
>
> Could someone point me to the files or modules within the OpenZiti codebase that are primarily responsible for implementing cryptographic functions

It's in a myriad of SDKs. I'd start by looking at [the c sdk](https://github.com/openziti/ziti-sdk-c/blob/4271e3e3ef299a1a16fa2c6282a61144207d7c45/library/crypto.c#L15), [the go sdk](https://github.com/openziti/sdk-golang/blob/bc63396b4897422da2187ba5088b1d4721922663/ziti/edge/network/conn.go#L314), etc.

OpenZiti also support mutual TLS between nodes so it's not just the end to end encryption that's useful to understand, you'll also want to look at the code for how links form between routers as well as how SDKs attach to edge routers.

hth