5 ms·

A promising contender to "replace" GPG in which you might be interested is age: https://github.com/FiloSottile/age https://github.com/FiloSottile/age It's base

A promising contender to "replace" GPG in which you might be interested is age: https://github.com/FiloSottile/age https://github.com/FiloSottile/age It's based on ChaCha20-Poly1305 AEAD and the author is well respected in the crypto community.

anta40 6y ago
So it's OK to use Age for sending secure emails? FYI, no I'm not in the millitary/intelligence agency. I'm just a software developer who like to send, say source codes or documents securely.
mongol 6y ago
Interesting. Does it have momentum behind it?
- tptacek 6y ago
  It's the non-GPG general-purpose encryption tool with the most momentum, you can say that much. Something that surprised me when I researched this (I wrote a similar tool internally at my last job, along with writing a blog post about the inadequacy of PGP) is that general-purpose encryption doesn't really have as many use cases as you'd assume. The reason for that is that modern cryptosystems are purpose-built for applications. Messaging cryptography (and email is a messaging system!) is different from backup cryptography, which is in turn different from disk cryptography. Probably single most common application of general-purpose cryptography is for cryptographic tokens (most common subset: cookies). But even there, your cryptography tends to be specialized, in terms of what it doesn't have --- in particular, metadata, which tends to be an antifeature for tokens. (I like Age a lot and you should use it if it makes sense for your application, though plain-ol'-secretbox is probably the right call for your encrypted cookie).
acqq 6y ago
The biggest problem for me (note: others may not care or consider that an advantage): implemented in go. I'm however interested in something as small as possible, with minimal number of dependencies and implemented in C. Yes I know it's an old language with its own issues. But C is the "highest level" I at this moment consider acceptable for something that should be a competition to GPG.
- da_big_ghey 6y ago
  That's a potential concern, as C is still probably unrivaled for portability. However, portability is not the only concern. Age also has a spec, so it can be reimplemented in other languages: https://age-encryption.org/v1 https://age-encryption.org/v1 There's already a Rust implementation: https://github.com/str4d/rage https://github.com/str4d/rage
  - acqq 6y ago
    Am I missing something or the existing tests in the repositories both in age and rage aren’t covering the specification? The other languages could be used for the "proof of concept" implementation or with which the additional comparison tests could be performed, but having C as the most important version is unavoidable.
- diegocg 6y ago
  To me, writing cryptographic software in a memory unsafe language these days seems a huge mistake.
  - acqq 6y ago
    Whichever your favorite language is, try researching its dependencies used in the cryptographic primitives, especially in the use cases where performance matters. More often than not, what at the end “does the job” is some library written in C (even with the asm parts) or marked with “unsafe” tags. The practice is still different to what the idealists believe.
sgtnasty 6y ago
Trying to read more about it, I cant get to the website they have listed: https://age-encryption.org/ https://age-encryption.org/ -> NET::ERR_CERT_COMMON_NAME_INVALID "You cannot visit age-encryption.org right now because the website uses HSTS."

anta40 6y ago

So it's OK to use Age for sending secure emails? FYI, no I'm not in the millitary/intelligence agency. I'm just a software developer who like to send, say source codes or documents securely.

mongol 6y ago

Interesting. Does it have momentum behind it?

tptacek 6y ago
It's the non-GPG general-purpose encryption tool with the most momentum, you can say that much. Something that surprised me when I researched this (I wrote a similar tool internally at my last job, along with writing a blog post about the inadequacy of PGP) is that general-purpose encryption doesn't really have as many use cases as you'd assume. The reason for that is that modern cryptosystems are purpose-built for applications. Messaging cryptography (and email is a messaging system!) is different from backup cryptography, which is in turn different from disk cryptography. Probably single most common application of general-purpose cryptography is for cryptographic tokens (most common subset: cookies). But even there, your cryptography tends to be specialized, in terms of what it doesn't have --- in particular, metadata, which tends to be an antifeature for tokens. (I like Age a lot and you should use it if it makes sense for your application, though plain-ol'-secretbox is probably the right call for your encrypted cookie).

acqq 6y ago

The biggest problem for me (note: others may not care or consider that an advantage): implemented in go. I'm however interested in something as small as possible, with minimal number of dependencies and implemented in C. Yes I know it's an old language with its own issues. But C is the "highest level" I at this moment consider acceptable for something that should be a competition to GPG.

da_big_ghey 6y ago
That's a potential concern, as C is still probably unrivaled for portability. However, portability is not the only concern. Age also has a spec, so it can be reimplemented in other languages: https://age-encryption.org/v1 https://age-encryption.org/v1 There's already a Rust implementation: https://github.com/str4d/rage https://github.com/str4d/rage
- acqq 6y ago
  Am I missing something or the existing tests in the repositories both in age and rage aren’t covering the specification? The other languages could be used for the "proof of concept" implementation or with which the additional comparison tests could be performed, but having C as the most important version is unavoidable.
diegocg 6y ago
To me, writing cryptographic software in a memory unsafe language these days seems a huge mistake.
- acqq 6y ago
  Whichever your favorite language is, try researching its dependencies used in the cryptographic primitives, especially in the use cases where performance matters. More often than not, what at the end “does the job” is some library written in C (even with the asm parts) or marked with “unsafe” tags. The practice is still different to what the idealists believe.

sgtnasty 6y ago

Trying to read more about it, I cant get to the website they have listed: https://age-encryption.org/ https://age-encryption.org/ -> NET::ERR_CERT_COMMON_NAME_INVALID "You cannot visit age-encryption.org right now because the website uses HSTS."