Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Age is a simple, modern and secure file encryption tool, format, and Go library

github.com

Post reply on HN
Print view View original

71–80 of 137 posts

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#71

Post by alexgartrell »

FiloSottile wrote: post #15

_o/ hi all, age author here! age is the one of my projects that grew most organically into an ecosystem. It's always great to see what people build with it. Happy to answer any questions. Here are some previous discussions 132 points on Feb 26, 2023 | 77 comments | https://news.ycombinator.com/item?id=34936504 126 points on Sept 26, 2022 | 54 comments | https://news.ycombinator.com/item?id=32980141 113 points on June…

Age is great. I used the rust crate to write an ftp server that encrypts the files before they hit disk (specific use case is having a drop box for my network scanner) and I love the simplicity and composability it provides.

One feature request: it would be awesome to have paraphrase encryption for age private keys.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#72

Post by FiloSottile »

vluft wrote: post #59
FiloSottile wrote: post #35

Earlier quoted context omitted.

Thanks for sharing, always happy when my projects inspire alternatives addressing different parts of the design space. Here are a few quick comments based on skimming the documentation, let me know if I misinterpreted anything. - signing support This has always been a non-goal for age. It makes the UX significantly more complex, but it's good if different tools have different goals. I can't quite make out from https:…

re: https://words.filippo.io/dispatches/age-authentication/#on-c... other than inelegance and the computational overhead, is there a reason why sign then encrypt then sign wouldn't work for this?

Assuming that implementation never skip verifying the second signature, and compare the signing keys, that should be ok.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#73

Post by FiloSottile »

alexgartrell wrote: post #71
FiloSottile wrote: post #15

_o/ hi all, age author here! age is the one of my projects that grew most organically into an ecosystem. It's always great to see what people build with it. Happy to answer any questions. Here are some previous discussions 132 points on Feb 26, 2023 | 77 comments | https://news.ycombinator.com/item?id=34936504 126 points on Sept 26, 2022 | 54 comments | https://news.ycombinator.com/item?id=32980141 113 points on June…

Age is great. I used the rust crate to write an ftp server that encrypts the files before they hit disk (specific use case is having a drop box for my network scanner) and I love the simplicity and composability it provides. One feature request: it would be awesome to have paraphrase encryption for age private keys.

Identity files can be passphrase encrypted and cmd/age will transparently ask for the passphrase before using them. Is that what you meant?

https://github.com/FiloSottile/age?tab=readme-ov-file#passph...

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#74

Post by quectophoton »

tptacek wrote: post #70
quectophoton wrote: post #19

The description claims it's "secure", but nothing pops up in the README when I Ctrl+F `audit`. So maybe take the "secure" claims with a grain of salt.

This drives me a little nuts. There are something like 4 firms† in the world generally recognized as qualified for assessing cryptosystems, against dozens well-known and qualified to audit software but not cryptography. Cryptography is a rare specialty for software security people. How were you going to know whether an "audit" for age was meaningful? † and, to be fair, dozens of independent practitioners

Oof, yeah maybe "audit" was the wrong word if it causes a reaction this strong.

I just wanted to say it would be nice to know what makes this implementation secure other than the creator's own words about their own project.

(EDIT: Though I guess you coming out to defend it is good enough signal to vouch in favor of it.)

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#76

Post by wuiheerfoj »

nabla9 wrote: post #26
FiloSottile wrote: post #15

_o/ hi all, age author here! age is the one of my projects that grew most organically into an ecosystem. It's always great to see what people build with it. Happy to answer any questions. Here are some previous discussions 132 points on Feb 26, 2023 | 77 comments | https://news.ycombinator.com/item?id=34936504 126 points on Sept 26, 2022 | 54 comments | https://news.ycombinator.com/item?id=32980141 113 points on June…

Maybe I'm dense but I can't figure out howto verify/authenticate encrypted files. Is there something missing in the documentation.

Afaik the x25519 recipient uses chacha20poly1305 which is authenticated

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#77

Post by bpicolo »

quectophoton wrote: post #22
klabb3 wrote: post #21

Earlier quoted context omitted.

Meh. The author of age is very experienced and known specifically for security, crypto and within the implementation language (Go). Audits are only as good as the competence of the auditors and can often turn into checklist rituals. It certainly doesn’t hurt, but audits are not a panacea.

Agreed, but IMHO claiming that a crypto library is secure without providing independent verification, is like claiming something is fast without providing benchmarks. (And both are the same in the sense that neither is a panacea.) I'm only bringing up audits because such claim was made, but maybe I should have said "independent verification" instead since it's more general.

The library is out in the world. Audit at will.

Have you seen Filippo's credentials? He's overwhelmingly qualified for this. https://github.com/FiloSottile

> Today, I maintain the cryptography packages that ship as part of the Go standard library (crypto/… and golang.org/x/crypto/…), including the TLS, SSH, and low-level implementations, such as elliptic curves, RSA, and ciphers. These packages are critical to virtually every Go application, securing HTTPS requests, implementing authentication, and providing encryption.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#78

Post by jjice »

It would be fantastic if Age (or at least something similar) could become standard on Unix machines. I'd love a more Unix-philosophy following tool than GPG/PGP to be around for encryption. That said, I don't think new standard tools for Unix machines are very common. The closest thing I can think of in the last while is `jq`, but it's not "preinstalled on your machine" kind of standard, just "my script might just use it and expect you to have it" kind of standard.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#79

Post by ReptileMan »

jjice wrote: post #78

It would be fantastic if Age (or at least something similar) could become standard on Unix machines. I'd love a more Unix-philosophy following tool than GPG/PGP to be around for encryption. That said, I don't think new standard tools for Unix machines are very common. The closest thing I can think of in the last while is `jq`, but it's not "preinstalled on your machine" kind of standard, just "my script might just us…

>just "my script might just use it and expect you to have it"

That is one path to standardizing something - using it.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#80

Post by CGamesPlay »

vaylian wrote: post #37
nabla9 wrote: post #26

Earlier quoted context omitted.

Maybe I'm dense but I can't figure out howto verify/authenticate encrypted files. Is there something missing in the documentation.

Age is designed for a single purpose: Encryption and decryption of files. To create digital signatures use another specialized tool like minisign instead. Specialized tools are simpler than one do-it-all tool.

Simpler, but not necessarily as capable! From https://words.filippo.io/dispatches/age-authentication/>:

> If you encrypt and then sign, an attacker can strip your signature, replace it with their own, and make it look like they encrypted the file even if they don't actually know the contents.

> If you sign and then encrypt, the recipient can decrypt the file, keep your signature, and encrypt it to a different recipient, making it look like you intended to send the file to them.

Post reply on HN