Enable CurveCP by default about libsodium

[jedisct1]

The current CurveCP code is currently a proof of concept, and as you pointed out, some people have suggested possible ways to improve the protocol itself.
To make it useable, the libcurvecp API will change and the protocol will change. While it's being worked on, things can be broken and big bad bugs can be introduced. So I think that enabling it by default is a bit premature, especially since it doesn't work on Windows for now.

[tarcieri]

My motivation is I'd like to develop some software which targets CurveCP, not with the intention of shipping it right away, but with the goal of eventually integrating with a "beta quality release". I intend to have large "experimental" warnings all over my software for quite some time. I'd like for other developers of the software, or perhaps early adopters who aren't, say, fighting an oppressive regime to be able to experiment with CurveCP-based software without having to build from source.

I think if these concerns about the highly experimental nature of CurveCP can be communicated to end users of the software effectively enough, it isn't irresponsible to include it by default.

Some other problems: right now we're integration testing RbNaCl against libsodium release tarballs on Travis. If we wanted to add an experimental CurveCP API (still need to make an issue for this on the RbNaCl tracker) we couldn't use the release tarballs, but would have to build from source.

I totally understand if you want to keep CurveCP out by default, and I agree that it shouldn't be there unless there's Sodium documentation in place to make sure nobody chances upon it and starts using it without being aware of its experimental status. However, at the same time, I want to improve traction among early adopters who have been made fully aware of its experimental status, especially when Rome is burning. I honestly think we need a replacement for TLS sooner than later, and CurveCP is our best bet.

[tarcieri]

Perhaps this suitably warns a potential user that they're playing with plutonium?

[jedisct1]

Does Travis actually prevents using autoconf flags?

My concern, besides Windows, is about package maintainers. They probably don't want experimental code to be part of their packages.

We can enable it by default and turn --enable-curvecp into --disable-curvecp, though.

[tarcieri]

That alone would be awesome

[tarcieri]

Opened an issue on RbNaCl:

RubyCrypto/rbnacl#47

[jedisct1]

Ok, after discussion, a new project, libchloride, will handle the networking part.