4 ms·

Have You Ever Heard of the Fernet Encryption Algorithm?

11 points by freedude 3y ago

jb1991 3y ago
Yes.
googlryas 3y ago
https://github.com/fernet/spec/blob/master/Spec.md https://github.com/fernet/spec/blob/master/Spec.md It's just a simple format specification using standard crypto primitives. > AES in CBC mode with a 128-bit key for encryption; using PKCS7 padding. > HMAC using SHA256 for authentication.
- hashstring 3y ago
  What is it then really? This sounds like a wrapper function…
  - woodruffw 3y ago
    It’s a high-level interface for authenticated encryption. Calling it an algorithm is like calling HTTP an algorithm; it’s true in the most useless sense.
  - nneonneo 3y ago
    Yep, it's a wrapper around some cryptographic primitives that is fairly misuse-resistant. It's not hard to screw up using the individual primitives in such a way that you lose the desirable cryptographic properties (for example, not authenticating the IV, making the plaintext vulnerable to CBC bitflip attacks); it's harder to screw up using Fernet.
aneutron 3y ago
Not sure the linked project is the up to date one. I regularly use the 'cryptography' package that has a 'Fernet' object in 'cryptography.fernet'. And it is in cryptography so I trust they maintain it at least a bare minimum. It is an amazing blackbox that assures me I can just provide a key and a ciphertext and rest easy that my data is correctly decrypted and autehnticated !
tptacek 3y ago
Fernet isn't an algorithm. It's a user-proof library for doing authenticated AES encryption; it is essentially Python's answer to Rails' MessageEncryptor, and has had more success than MessageEncryptor at becoming a standard for its ecosystem. The real lesson here though: don't get cryptography advice from SANS. Cryptography is a specialized field; SANS is pretty close to the opposite of that.
- jamiesonbecker 3y ago
  The punchline is that the pip package is apparently malware.
QuercusMax 3y ago
This is a horrendously bad post, misleading all the way through.
eternityforest 3y ago
When would someone use this over libsodium(Or libhydrogen? Is that considered secure yet?)? It seems python-specific. I love python, but I'm a fan of universal standards.

11 points by freedude 3y ago

jb1991 3y ago

Yes.

https://github.com/fernet/spec/blob/master/Spec.md https://github.com/fernet/spec/blob/master/Spec.md It's just a simple format specification using standard crypto primitives. > AES in CBC mode with a 128-bit key for encryption; using PKCS7 padding. > HMAC using SHA256 for authentication.

hashstring 3y ago
What is it then really? This sounds like a wrapper function…
- woodruffw 3y ago
  It’s a high-level interface for authenticated encryption. Calling it an algorithm is like calling HTTP an algorithm; it’s true in the most useless sense.
- nneonneo 3y ago
  Yep, it's a wrapper around some cryptographic primitives that is fairly misuse-resistant. It's not hard to screw up using the individual primitives in such a way that you lose the desirable cryptographic properties (for example, not authenticating the IV, making the plaintext vulnerable to CBC bitflip attacks); it's harder to screw up using Fernet.

aneutron 3y ago

Not sure the linked project is the up to date one. I regularly use the 'cryptography' package that has a 'Fernet' object in 'cryptography.fernet'. And it is in cryptography so I trust they maintain it at least a bare minimum. It is an amazing blackbox that assures me I can just provide a key and a ciphertext and rest easy that my data is correctly decrypted and autehnticated !

tptacek 3y ago

Fernet isn't an algorithm. It's a user-proof library for doing authenticated AES encryption; it is essentially Python's answer to Rails' MessageEncryptor, and has had more success than MessageEncryptor at becoming a standard for its ecosystem. The real lesson here though: don't get cryptography advice from SANS. Cryptography is a specialized field; SANS is pretty close to the opposite of that.

jamiesonbecker 3y ago
The punchline is that the pip package is apparently malware.

QuercusMax 3y ago

This is a horrendously bad post, misleading all the way through.

eternityforest 3y ago

When would someone use this over libsodium(Or libhydrogen? Is that considered secure yet?)? It seems python-specific. I love python, but I'm a fan of universal standards.