Cryptography best practices about vapor

[tanner0101]

These are all very valid points. Would you have time to submit a PR that addresses them?

[elithrar]

In addition, something like https://github.com/krzyzanowskim/CryptoSwift may help reduce some maintenance/implementation burden.

Boiling it down into two actions:

• As @comex touches on, HMAC-SHA-256 would be the way to go for signing cookies
• Pull 256 bits (32 bytes) from /dev/urandom when you need random bytes. Don't hash it or combine with a timestamp (unless sorting/ordering is a feature you need). base64'ing the output should be enough.

If @comex doesn't have time to pick up the PR I'd be interested, but haven't authored Swift before (plenty of Go, though) so would need to get a dev env. up first.

[tanner0101]

CryptoSwift seems like a great option. I'd be very interested to see a PR implementing this.

Also if you need help setting up a dev environment, we have a lot of smart guys in the Vapor Slack that could help you out wit that.

[shnhrrsn]

+1 for CryptoSwift, using it in a different project and it's solid

[tanner0101]

Added CryptoSwift to the roadmap https://github.com/qutheory/vapor/wiki/Roadmap