51 ms·

This is what I was referencing: >For public key cryptography, the notion of authenticated encryption becomes more complicated. I wrote a three-part blog post a

This is what I was referencing: >For public key cryptography, the notion of authenticated encryption becomes more complicated. I wrote a three-part blog post about it. There are public key authenticated encryption modes, such as NaCl’s box, but age doesn’t use one of those and instead opts for unauthenticated ECIES encryption (like JOSE’s ECDH-ES algorithm) using X25519. So while age uses symmetric authenticated encryption for the file contents, the symmetric file key is itself encrypted using an unauthenticated mode. >it is completely insecure to pipe the output of age into another tool without independently establishing the authenticity of the file. I disagree that it's outside of age's scope. One of the example use cases in the readme is piping age to another program such as tar. This makes age (without minisign or whatever) useless and/or insecure for most people.

tptacek 4y ago
No, it doesn't, and, in particular, your summary of this point as "age doesn't use authenticated encryption" is grossly inaccurate.
- chlorion 4y ago
  From the link I posted about: >you can’t simply use a static key pair with age to achieve authenticated encryption as age’s key-wrapping algorithm is completely insecure when used in this way >an attacker cannot tamper with the encrypted ciphertext, but they can completely replace it with one of their own choosing >it is completely insecure to pipe the output of age into another tool without independently establishing the authenticity of the file Can you go into depth about why it's "grossly inaccurate"? So far you haven't actually explained why it's not correct, and these quotes seem to directly support everything that I have said. Is there an issue with the authors analysis perhaps? Has age since then resolved any of this? I am curious what makes you disagree here. I suspect that what you are arguing is mostly semantics about age using authenticated encryption during the symmetric phase of the whole process, but since the symmetric key is not authenticated that defeats the purpose as far as I can tell.

tptacek 4y ago

No, it doesn't, and, in particular, your summary of this point as "age doesn't use authenticated encryption" is grossly inaccurate.

chlorion 4y ago
From the link I posted about: >you can’t simply use a static key pair with age to achieve authenticated encryption as age’s key-wrapping algorithm is completely insecure when used in this way >an attacker cannot tamper with the encrypted ciphertext, but they can completely replace it with one of their own choosing >it is completely insecure to pipe the output of age into another tool without independently establishing the authenticity of the file Can you go into depth about why it's "grossly inaccurate"? So far you haven't actually explained why it's not correct, and these quotes seem to directly support everything that I have said. Is there an issue with the authors analysis perhaps? Has age since then resolved any of this? I am curious what makes you disagree here. I suspect that what you are arguing is mostly semantics about age using authenticated encryption during the symmetric phase of the whole process, but since the symmetric key is not authenticated that defeats the purpose as far as I can tell.