4 ms·

_o/ hi all, age author here! age is the one of my projects that grew most organically into an ecosystem. It's always great to see what people build with it. Hap

_o/ hi all, age author here! age is the one of my projects that grew most organically into an ecosystem. It's always great to see what people build with it. Happy to answer any questions. Here are some previous discussions 132 points on Feb 26, 2023 | 77 comments | https://news.ycombinator.com/item?id=34936504 https://news.ycombinator.com/item?id=34936504 126 points on Sept 26, 2022 | 54 comments | https://news.ycombinator.com/item?id=32980141 https://news.ycombinator.com/item?id=32980141 113 points on June 11, 2022 | 33 comments | https://news.ycombinator.com/item?id=31705670 https://news.ycombinator.com/item?id=31705670 494 points on Sept 6, 2021 | 88 comments | https://news.ycombinator.com/item?id=28435613 https://news.ycombinator.com/item?id=28435613 466 points on Dec 27, 2019 | 199 comments | https://news.ycombinator.com/item?id=21895671 https://news.ycombinator.com/item?id=21895671 and here some related resources - a list of age ecosystem projects https://github.com/FiloSottile/awesome-age https://github.com/FiloSottile/awesome-age - the format specification https://c2sp.org/age https://c2sp.org/age - the Go library docs https://pkg.go.dev/filippo.io/age https://pkg.go.dev/filippo.io/age - the CLI man page https://filippo.io/age/age.1 https://filippo.io/age/age.1 - the large reusable test suite (which I should write about!) https://c2sp.org/CCTV/age https://c2sp.org/CCTV/age - an interoperable Rust implementation by @str4d https://github.com/str4d/rage https://github.com/str4d/rage - an official TypeScript implementation https://github.com/FiloSottile/typage https://github.com/FiloSottile/typage (based on libsodium.js in the latest version, and on pure-js Noble libraries on main) - a YubiKey plugin by @str4d https://github.com/str4d/age-plugin-yubikey https://github.com/str4d/age-plugin-yubikey - the plugin protocol specification https://c2sp.org/age-plugin https://c2sp.org/age-plugin - a Windows GUI by @spieglt https://github.com/spieglt/winage https://github.com/spieglt/winage - a discussion of the authentication properties of age https://words.filippo.io/dispatches/age-authentication/ https://words.filippo.io/dispatches/age-authentication/ - a discussion of the plugin architecture https://words.filippo.io/dispatches/age-plugins/ https://words.filippo.io/dispatches/age-plugins/ - a discussion of a potential post-quantum plugin https://words.filippo.io/dispatches/post-quantum-age/ https://words.filippo.io/dispatches/post-quantum-age/ - a password-store fork that uses age instead of gpg https://github.com/FiloSottile/passage https://github.com/FiloSottile/passage (see also: how I use it with a YubiKey https://words.filippo.io/dispatches/passage/ https://words.filippo.io/dispatches/passage/)

nabla9 2y ago
Maybe I'm dense but I can't figure out howto verify/authenticate encrypted files. Is there something missing in the documentation.
- vaylian 2y ago
  Age is designed for a single purpose: Encryption and decryption of files. To create digital signatures use another specialized tool like minisign instead. Specialized tools are simpler than one do-it-all tool.
  - CGamesPlay 2y ago
    Simpler, but not necessarily as capable! From < https://words.filippo.io/dispatches/age-authentication/ https://words.filippo.io/dispatches/age-authentication/>: > If you encrypt and then sign, an attacker can strip your signature, replace it with their own, and make it look like they encrypted the file even if they don't actually know the contents. > If you sign and then encrypt, the recipient can decrypt the file, keep your signature, and encrypt it to a different recipient, making it look like you intended to send the file to them.
    - upofadown 2y ago
      Both cases assume that the user doesn't understand what a signature means. In either case it means that the signer certified the thing signed. Are paper signatures getting so rare that we are collectively starting to forget this?
    - PhilipRoman 2y ago
      > make it look like they encrypted the file even if they don't actually know the contents. I might as well encrypt a message "add $10000 to my account" with the bank's public key, sign it with my own key and send it...
- wuiheerfoj 2y ago
  Afaik the x25519 recipient uses chacha20poly1305 which is authenticated

nabla9 2y ago

Maybe I'm dense but I can't figure out howto verify/authenticate encrypted files. Is there something missing in the documentation.

vaylian 2y ago
Age is designed for a single purpose: Encryption and decryption of files. To create digital signatures use another specialized tool like minisign instead. Specialized tools are simpler than one do-it-all tool.
- CGamesPlay 2y ago
  Simpler, but not necessarily as capable! From < https://words.filippo.io/dispatches/age-authentication/ https://words.filippo.io/dispatches/age-authentication/>: > If you encrypt and then sign, an attacker can strip your signature, replace it with their own, and make it look like they encrypted the file even if they don't actually know the contents. > If you sign and then encrypt, the recipient can decrypt the file, keep your signature, and encrypt it to a different recipient, making it look like you intended to send the file to them.
  - upofadown 2y ago
    Both cases assume that the user doesn't understand what a signature means. In either case it means that the signer certified the thing signed. Are paper signatures getting so rare that we are collectively starting to forget this?
  - PhilipRoman 2y ago
    > make it look like they encrypted the file even if they don't actually know the contents. I might as well encrypt a message "add $10000 to my account" with the bank's public key, sign it with my own key and send it...
wuiheerfoj 2y ago
Afaik the x25519 recipient uses chacha20poly1305 which is authenticated