5 ms·
meh. https://stackoverflow.com/questions/16056135/how-to-use-openssl-to-encrypt-decrypt-files/16056298#16056298 https://stackoverflow.com/questions/16056135/ho
by TedDoesntTalk 7y ago
meh.
https://stackoverflow.com/questions/16056135/how-to-use-openssl-to-encrypt-decrypt-files/16056298#16056298 https://stackoverflow.com/questions/16056135/how-to-use-open...
With that I'm guaranteed AES, a known-good encryption algorithm. I have no idea what these guys are doing without reading through their documentation. Hopefully they didn't roll their own.
- Natanael_L 7y agoWhat you're linking has now literally been edited with an update to suggest the tool age. The idea that "AES is enough" is like saying you don't need better winter clothes to go skiing because you have a good helmet. There's still more things left you need to protect than that! A secure block cipher mode and key management and IV generation, etc, is mandatory!
- tptacek 7y agoThat command line doesn't even produce authenticated ciphertext. I'm amazed that's the check-marked best answer on Stack Overflow.
- wolf550e 7y agoI have seen many questions on security stack exchange and /r/crypto where the correct answer should have been "use age", but because it didn't exist the correct answer was something bad. openssl CLI is not meant to be used in prod (both because not AEAD and because the man page tells you not to use it). gpg is bad. rolling your own CLI tool using libsodium is not for everyone.
- tptacek 7y agohttps://twitter.com/pwnallthethings/status/1210735552535752705 https://twitter.com/pwnallthethings/status/12107355525357527... I'd be nicer but for the "hopefully they didn't roll their own" at the end.
- TedDoesntTalk 7y agoIt's possible this is the wrong way to get AES on the command-line; I haven't done it and no need to right now. But that's missing my point entirely.
- coldtea 7y agoThe point being? You've linked to a command that's wrong, from a random internet "everybody gets to answer a question and everybody gets to vote for the best answer, no qualifications required" website, and wrote "with that I'm guaranteed AES, a known-good encryption algorithm" as if that means anything.
- TedDoesntTalk 7y agoOk, for the thick-headed: my point is I'll use AES. Good luck with your toy project. Also authenticated encryption is not something I want all the time. I don't always want an identity tied to cipher text, even if the identity is anonymous.
- tptacek 7y agoAuthenticated encryption has nothing to do with identity; you've confused message authentication with signatures.
- dependenttypes 7y agoEnjoy your efailv2.0!
- coldtea 7y ago>Ok, for the thick-headed: my point is I'll use AES. Good luck with your toy project. "AES" without specific qualifications and with instructions sourced from Stack Overflow is an ad-hoc toy project. Age, on the other hand, is a well specified, approved by several domain experts, best-practices project. In the end you can do whatever, but don't use some custom solution ("AES" or not) for anything where human lives or money might depend on. >Also authenticated encryption is not something I want all the time. I don't always want an identity tied to cipher text, even if the identity is anonymous. Identity is not what "authenticated encryption" is about. It's about protecting about certain classes of cipher-text attacks, which people (bad people, one would assume) can use to get information about your encryption.
- CiPHPerCoder 7y agoI made it better: https://stackoverflow.com/posts/16056298/revisions https://stackoverflow.com/posts/16056298/revisions