this post was submitted on 25 Jan 2022
2 points (100.0% liked)

Privacy

31918 readers
808 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
k_o_t@lemmy.ml
tmpod
Yayannick@lemmy.ml
ranok@sopuli.xyz
2
Discusstion about the age encryption tool (github.com)
submitted 2 years ago by sunblocker@lemmy.ml to c/privacy@lemmy.ml
9 comments fedilink hide all child comments
 

There is this tool called age written in go and a fully compatible Rust implementation called rage. They promise to be a simple tool for encrypting files and other things.

It only does encryption, using public key cryptography (Curve 25519 or SSH keys) or password based symmetric encryption. (Please excuse me glossing over some details here)

It only encrypts things, no signatures beyond AEAD involved. It aims to be minimalistic and do just one thing reasonably well instead of being a mediocre multi tool. It doesn't aim to be a full replacement for things like OpenPGP.

AFAICT there hasn't been a proper security audit yet. There seem to be some issues with the design as pointed out here which don't look like critical flaws to me, but then again I'm not a cryptography expert.

Some of the questions I want to throw into the discussions are:

  • Is it any good?
  • In which situation would you use it?
  • What are some alternatives that do it differently or maybe even better and why is that?

Bonus question: Is there a similar tool that uses an audited library like libsodium, and if not, would it be worth developing one?

top 9 comments
sorted by: hot top controversial new old
[–] X_Cli@lemmy.ml 1 points 2 years ago

Filippo Valsorda, the author of Age, is a qualified cryptographer and I can vouch for them, being myself an applied cryptographer. And many of my cryptographer friends do as well.

Age seems good to me BUT. I don't like streaming, and the article that you cite is on point. To me, streaming is unwise precisely because you can have truncation attacks. Or even length extension attacks. One may counter them using counters, but you will need a temporary storage until you know if the input is complete or not. And this defeats streaming.

Your application might be OK with truncation. That's for you to determine. Which is hard. If you can't decide, then you shoud stay away from streaming.

I wrote an article on this myself, a few weeks ago. I use that approach in production to secure some data that may be sent to me anonymously. It was reviewed by some cryptographers in my circles but I do not claim that it is a trusted library.

[–] CHEFKOCH@lemmy.ml -1 points 2 years ago* (last edited 2 years ago) (2 children)

View things

  • Your post maybe belongs into security.
  • This is not done by professionals or a bigger group which means that they do not intended to use this as professional replacement. I only mention it in case someone wants to use it on enterprise environment. 40 contributer might seems big but it is not, not for such huge project.
  • The tool is not meant as FDE tool, alias to replace VeraCrypt or tools specifically designed for one single thing alias KeePass.
  • The tool is an universal program, you can use this for bunch of things.

About audits as measurement

An independent audit is expensive and not meant as an overall approval certificate. It is more designed to be a snapshot at that time when someone external checked your code, done by security experts and professionals. This does not mean, even if the code is vulnerable, that it stays that way, nor does it indicate that just because there are flaws found, that it was actually abused in the real-world because in lots of cases abusing some vulnerabilities requires lots of effort, infecting the host, manipulating signatures, .. yada yada yada ...

About the tool

Good is subjective term, if you just want to encrypt some single files it is more than sufficient enough.

Simplicity

Here are the main arguments why I think age was developed.

  • Encrypted files by pass and keys are smaller compared to the competition.
  • It works smoothly with SSH keys which are perfectly recognized by possibly any developer.
  • No need for external client, such as OpenKeychain for Android or GpgWin/Kleopatra for Windows.
  • Embed-able in Rust and Go, which means there are third-party libraries, no need to call gpg --decrypt ... from the command line.
  • You can use age-plugin-yubikey to combine it with Yubikey and use it for password reasons.

Alternatives

There are similar tools like libsodium-file-crypter for specific platforms and needs. Rage is also an alternative.

  • ChaCha20-BLAKE2b
  • OpenKeychain
  • Picocrypt
  • bitwarden-go
  • cobra
  • minisign
  • pass-tomb
  • poetry2nix
  • sops

The alternatives list depends heavily on the question if you want to use this mainly as password manager or file encryption utility, or even as all-in-one solution.

[–] sunblocker@lemmy.ml 1 points 2 years ago (1 children)

libsodium-file-crypter hasn't received any commits in the past 4 years. Looks abandoned to me.

[–] CHEFKOCH@lemmy.ml -1 points 2 years ago* (last edited 2 years ago)

Or no one found something. Commit history is not an indicator that no one is working on something, more like that no one submitted something. If its finished, then there is no need to commit something.

I could post an list of tools designed for enterprise environment users. There are not man because in such an environment you basically only use audited programs due to assurance company reasons, in case there are problems because the first and last question is if issues were known and if that could have been prevented.

You can also inspect open audit databases and check what was audited already.

[–] X_Cli@lemmy.ml 0 points 2 years ago (1 children)

Can you explain how you intend to use minisign as a replacement for age, please ? 😂

[–] CHEFKOCH@lemmy.ml 0 points 2 years ago* (last edited 2 years ago) (1 children)

If you have nothing useful to add here you should not answer.

Age has some plugin capabilities, there are plugins for like e.g. Yubikey, so you can also create plugins for file verification.

[–] X_Cli@lemmy.ml 2 points 2 years ago (1 children)

Still bossing people around, I see. "You should not answer" "Your post belongs elsewhere". You never change :) Your intimidation attempts are ineffective on me. You should move on.

Age plugins are not Age. Minisign is an excellent tool. It is not a replacement for Age.

[–] CHEFKOCH@lemmy.ml -5 points 2 years ago* (last edited 2 years ago) (1 children)

Still trying to undermine peoples opinions by cherry picking things to add nothing useful for the discussion trying to discredit me based on things you do not understand.

You can code plugins surround age and you can utilize them, apparently you do not understand it. You can check signatures with age too, just saying.

It is a replacement for those who mainly use age for that purpose.

[–] X_Cli@lemmy.ml 1 points 2 years ago

Can you provide a link to that "age signature plugin", please?