the fact that Tahoe-LAFS depends on PyCrypto makes people think it might be insecure

[zooko]

For example, here is a conversation on twitter featuring some good security researchers and one of the original authors of the AES code in PyCrypto:

​https://twitter.com/pbarreto/status/532950080761131008

(He's the one saying "That's an *old* code indeed. I *would* presume its only purpose now is to study cache-based attacks.".)

Now, we've already written docs warning our users not to rely on confidentiality of the SFTP channel because of this, in SftpFrontend and docs/frontends/FTP-and-SFTP.rst​, but of course most users don't read most docs, so they might actually rely on confidentiality of the SFTP channel. Also, the fact that we depend on PyCrypto at all causes people to think that Tahoe-LAFS might be only as secure as PyCrypto is.

The best solution would, of course, be to get rid of PyCrypto entirely, but that is up to the Twisted project (​https://twistedmatrix.com/trac/ticket/7413), not up to us. In the meantime, I don't think there's much we can do, since it is already documented. So I'm going to immediately close this bug as "someone else's problem".

Also, here is a ticket for PyCrypto to fix their timing leak: ​https://github.com/dlitz/pycrypto/issues/103