3 ms·
Is there a backup tool yet for age? Also, I would like to point out a major foot-gun with Age. I was using age in the symmetric mode, glad that I am getting a
by aborsy 4y ago
Is there a backup tool yet for age?
Also, I would like to point out a major foot-gun with Age. I was using age in the symmetric mode, glad that I am getting a cleanly written ChaCha20-Poly1305 symmetric cipher. This is supposed to be 256-bits symmetric encryption, and quantum-resistance.
But if I recall, it seems that the age key file itself is 128 bits! Thus in the symmetric mode, Age provides only 128 bits of security. This is substandard, and in particular secure only until 2035 or so.
Worse, Age creates by default a 10-word password from BIP-39 list. That’s actually 110 bits, in default configuration. Again, a good deal weakening the security.
I reverted back to GPG AES-256. AES-GCM appears in 2.3.
Correct me if I’m wrong.
————-
Update: Here are the links for the security level of 128 bits in Age:
https://github.com/FiloSottile/age/discussions/423 https://github.com/FiloSottile/age/discussions/423
https://github.com/C2SP/C2SP/blob/main/age.md https://github.com/C2SP/C2SP/blob/main/age.md
- vaylian 4y ago> Is there a backup tool for age? Can you elaborate? You can combine age with tar to create an encrypted archive. > But it seems the key itself is 128 bits! Thus in the symmetric mode, Age provides 128 bits of security. Maybe create a github issue for it?
- aborsy 4y agoTar and encrypt is 1990s backup. You surely don’t expect that everyday I tar 500 GB and upload to cloud, when one file has changed. I mean something like Restic, but using Age as backend. There is an issue for it in GitHub. That’s how I found this.
- formerly_proven 4y agoYou'd want your backups to be signed, which age will never do, so you don't want a backup tool using age as a backend.
- aborsy 4y agoYeah, but you have to generate the signature of the encrypted 1TB file with Gpg :)
- str4d 4y ago> But if I recall, it seems that the age key file itself is 128 bits! Thus in the symmetric mode, Age provides only 128 bits of security. This is substandard, and in particular secure only until 2035 or so. This is not the case. To meet NIST's Category 1 requirements, post-quantum cryptography "must require computational resources comparable to or greater than those required for key search on a block cipher with a 128-bit key (e.g. AES128)" [0]. It is therefore completely appropriate to pair any Category 1 post-quantum KEMs with 128-bit symmetric keys. See [1] for more details about post-quantum age. Symmetric passphrase age similarly is fine because it's the same as the post-quantum KEM case but without the KEM. [0] https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria) https://csrc.nist.gov/projects/post-quantum-cryptography/pos... [1] https://words.filippo.io/dispatches/post-quantum-age/ https://words.filippo.io/dispatches/post-quantum-age/
- andreareina 4y agoDoesn't Grover Search make the problem half the bits easier?
- aborsy 4y agoI am not sure if I follow. A symmetric key of length 128 bits has only 64 bits of security with quantum computers. The age developer mentioned this in a GitHub issue (although I think the fact that the security level is only 128 bits is very important and shouldn’t have been tucked away in the GitHub issues brought about by someone else; it should have been highlighted in the documentation, which doesn’t mention the security guarantees). Here is part of the code, considering that the file key is 128 bits. salt = ephemeral share || recipient info = "age-encryption.org/v1/X25519" shared secret = X25519(ephemeral secret, recipient) wrap key = HKDF-SHA-256(ikm = shared secret, salt, info) body = ChaCha20-Poly1305(key = wrap key, plaintext = file key)