3 ms·

I really like the general ideas behind age, like being composable in shell commands and having a more narrow focus than something like GPG. My biggest frustrat

I really like the general ideas behind age, like being composable in shell commands and having a more narrow focus than something like GPG. My biggest frustration with GPG is that it needs to have keys imported to do anything useful. I greatly prefer just storing the keys in the file system! Related to that last point, Gentoo uses GPG to verify distfiles sometimes and it ends up creating a lot of "dummy" keyrings and throwing them away to circumvent this limitation of GPG! (I haven't dug too deeply into the code so it's possible that I am wrong here, but this is my current understanding) My two primary issues with age that have prevented me from using it are that it doesn't use authenticated encryption (see links below) and that there is no way to encrypt/decrypt and make signatures with a single key pair (at least afaik). If I am encrypting files I want to be able to trust the contents of it fully, otherwise it's really not that useful for me personally! https://github.com/FiloSottile/age/issues/59 https://github.com/FiloSottile/age/issues/59 https://neilmadden.blog/2019/12/30/a-few-comments-on-age/ https://neilmadden.blog/2019/12/30/a-few-comments-on-age/

tptacek 4y ago
Obviously, age does use authenticated encryption. What Madden is pointing out is that age doesn't support signing or origin authentication --- not because you'd never need it, but because it's out of scope for what age does. Madden objects to the notion that you'd use minisign to sign an age ciphertext, but it's not clear why we should care about that objection: he's just saying that age loses an efficiency claim when ciphertexts have to be preprocessed to be verified. Meanwhile, there is no worse format in the world when it comes to authentication than PGP, with the (ongoing!) saga of it's weird, unsound MDC.
- chlorion 4y ago
  This is what I was referencing: >For public key cryptography, the notion of authenticated encryption becomes more complicated. I wrote a three-part blog post about it. There are public key authenticated encryption modes, such as NaCl’s box, but age doesn’t use one of those and instead opts for unauthenticated ECIES encryption (like JOSE’s ECDH-ES algorithm) using X25519. So while age uses symmetric authenticated encryption for the file contents, the symmetric file key is itself encrypted using an unauthenticated mode. >it is completely insecure to pipe the output of age into another tool without independently establishing the authenticity of the file. I disagree that it's outside of age's scope. One of the example use cases in the readme is piping age to another program such as tar. This makes age (without minisign or whatever) useless and/or insecure for most people.
  - tptacek 4y ago
    No, it doesn't, and, in particular, your summary of this point as "age doesn't use authenticated encryption" is grossly inaccurate.
    - chlorion 4y ago
      From the link I posted about: >you can’t simply use a static key pair with age to achieve authenticated encryption as age’s key-wrapping algorithm is completely insecure when used in this way >an attacker cannot tamper with the encrypted ciphertext, but they can completely replace it with one of their own choosing >it is completely insecure to pipe the output of age into another tool without independently establishing the authenticity of the file Can you go into depth about why it's "grossly inaccurate"? So far you haven't actually explained why it's not correct, and these quotes seem to directly support everything that I have said. Is there an issue with the authors analysis perhaps? Has age since then resolved any of this? I am curious what makes you disagree here. I suspect that what you are arguing is mostly semantics about age using authenticated encryption during the symmetric phase of the whole process, but since the symmetric key is not authenticated that defeats the purpose as far as I can tell.
VTimofeenko 4y ago
I believe you are correct, gemato (the actual tool used to verify signatures and whatnot) creates temporary keyrings in tmp.

tptacek 4y ago

Obviously, age does use authenticated encryption. What Madden is pointing out is that age doesn't support signing or origin authentication --- not because you'd never need it, but because it's out of scope for what age does. Madden objects to the notion that you'd use minisign to sign an age ciphertext, but it's not clear why we should care about that objection: he's just saying that age loses an efficiency claim when ciphertexts have to be preprocessed to be verified. Meanwhile, there is no worse format in the world when it comes to authentication than PGP, with the (ongoing!) saga of it's weird, unsound MDC.

chlorion 4y ago
This is what I was referencing: >For public key cryptography, the notion of authenticated encryption becomes more complicated. I wrote a three-part blog post about it. There are public key authenticated encryption modes, such as NaCl’s box, but age doesn’t use one of those and instead opts for unauthenticated ECIES encryption (like JOSE’s ECDH-ES algorithm) using X25519. So while age uses symmetric authenticated encryption for the file contents, the symmetric file key is itself encrypted using an unauthenticated mode. >it is completely insecure to pipe the output of age into another tool without independently establishing the authenticity of the file. I disagree that it's outside of age's scope. One of the example use cases in the readme is piping age to another program such as tar. This makes age (without minisign or whatever) useless and/or insecure for most people.
- tptacek 4y ago
  No, it doesn't, and, in particular, your summary of this point as "age doesn't use authenticated encryption" is grossly inaccurate.
  - chlorion 4y ago
    From the link I posted about: >you can’t simply use a static key pair with age to achieve authenticated encryption as age’s key-wrapping algorithm is completely insecure when used in this way >an attacker cannot tamper with the encrypted ciphertext, but they can completely replace it with one of their own choosing >it is completely insecure to pipe the output of age into another tool without independently establishing the authenticity of the file Can you go into depth about why it's "grossly inaccurate"? So far you haven't actually explained why it's not correct, and these quotes seem to directly support everything that I have said. Is there an issue with the authors analysis perhaps? Has age since then resolved any of this? I am curious what makes you disagree here. I suspect that what you are arguing is mostly semantics about age using authenticated encryption during the symmetric phase of the whole process, but since the symmetric key is not authenticated that defeats the purpose as far as I can tell.

VTimofeenko 4y ago

I believe you are correct, gemato (the actual tool used to verify signatures and whatnot) creates temporary keyrings in tmp.