3 ms·

It's possible this is the wrong way to get AES on the command-line; I haven't done it and no need to right now. But that's missing my point entirely.

coldtea 7y ago
The point being? You've linked to a command that's wrong, from a random internet "everybody gets to answer a question and everybody gets to vote for the best answer, no qualifications required" website, and wrote "with that I'm guaranteed AES, a known-good encryption algorithm" as if that means anything.
- TedDoesntTalk 7y ago
  Ok, for the thick-headed: my point is I'll use AES. Good luck with your toy project. Also authenticated encryption is not something I want all the time. I don't always want an identity tied to cipher text, even if the identity is anonymous.
  - tptacek 7y ago
    Authenticated encryption has nothing to do with identity; you've confused message authentication with signatures.
  - dependenttypes 7y ago
    Enjoy your efailv2.0!
  - coldtea 7y ago
    >Ok, for the thick-headed: my point is I'll use AES. Good luck with your toy project. "AES" without specific qualifications and with instructions sourced from Stack Overflow is an ad-hoc toy project. Age, on the other hand, is a well specified, approved by several domain experts, best-practices project. In the end you can do whatever, but don't use some custom solution ("AES" or not) for anything where human lives or money might depend on. >Also authenticated encryption is not something I want all the time. I don't always want an identity tied to cipher text, even if the identity is anonymous. Identity is not what "authenticated encryption" is about. It's about protecting about certain classes of cipher-text attacks, which people (bad people, one would assume) can use to get information about your encryption.
tedunangst 7y ago
Your point is that you can do the wrong thing with OpenSSL so that means you don't need a tool that does the right thing? That is not a solid point.

coldtea 7y ago

The point being? You've linked to a command that's wrong, from a random internet "everybody gets to answer a question and everybody gets to vote for the best answer, no qualifications required" website, and wrote "with that I'm guaranteed AES, a known-good encryption algorithm" as if that means anything.

TedDoesntTalk 7y ago
Ok, for the thick-headed: my point is I'll use AES. Good luck with your toy project. Also authenticated encryption is not something I want all the time. I don't always want an identity tied to cipher text, even if the identity is anonymous.
- tptacek 7y ago
  Authenticated encryption has nothing to do with identity; you've confused message authentication with signatures.
- dependenttypes 7y ago
  Enjoy your efailv2.0!
- coldtea 7y ago
  >Ok, for the thick-headed: my point is I'll use AES. Good luck with your toy project. "AES" without specific qualifications and with instructions sourced from Stack Overflow is an ad-hoc toy project. Age, on the other hand, is a well specified, approved by several domain experts, best-practices project. In the end you can do whatever, but don't use some custom solution ("AES" or not) for anything where human lives or money might depend on. >Also authenticated encryption is not something I want all the time. I don't always want an identity tied to cipher text, even if the identity is anonymous. Identity is not what "authenticated encryption" is about. It's about protecting about certain classes of cipher-text attacks, which people (bad people, one would assume) can use to get information about your encryption.

tedunangst 7y ago

Your point is that you can do the wrong thing with OpenSSL so that means you don't need a tool that does the right thing? That is not a solid point.