> feels like a weird (and footgun-shaped) middle ground.
hmm
> It is a weird and footgun-shaped middle ground.
Oh? HMMMMM :|
Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)
11–20 of 61 posts
Re: Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)
#12Why not zoidbe... I mean, why not open ssh? It's literally a CLI that does every crypto operation with every primitive (except some PQC)?
If you mean the OpenSSL CLI, it's hard to think of a more footgun-y cryptographic tool than the one that:
* defaults to unauthenticated encryption
* buries its one authenticated mode
* requires explicit command-line nonces
* defaults to an MD5 KDF
You could probably keep going for another 10 bullets. Never use the OpenSSL CLI for anything other than TLS stuff.
Re: Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)
#13(2024) My favourite part of these tools is the zany use of numbered file descriptors. `keypair` outputs the public key on fd 5 and secret key on fd 9. But signing reads the secret key on fd 8, while verification reads the public key on fd 4! Why aren't they the same?? I have to read the manpage every time.
I was wondering the same thing. My best guess is that is to guard against operator misuse. Like usb-a only plugging in one way. Anything that is secret will never accidentally print to stdout. String interpolation in bash with `—option $empty` might be safer than `8<$empty`. Have to explore more but yeah, this is a new pattern for me as well.
Re: Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)
#14Why not zoidbe... I mean, why not open ssh? It's literally a CLI that does every crypto operation with every primitive (except some PQC)?
If you mean the OpenSSL CLI, it's hard to think of a more footgun-y cryptographic tool than the one that: * defaults to unauthenticated encryption * buries its one authenticated mode * requires explicit command-line nonces * defaults to an MD5 KDF You could probably keep going for another 10 bullets. Never use the OpenSSL CLI for anything other than TLS stuff.
Yeah, the OpenSSL CLI sucks. So what's to be done?
Sure, we can build a 25519-specific tool with a less footgun-y interface. Fine, whatever, for that one use case.
Or we can build an alternative OpenSSL CLI that explodes OpenSSL and its numerous useful features in a general way and helps fix lots of use cases.
Re: Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)
#15Earlier quoted context omitted.
If you mean the OpenSSL CLI, it's hard to think of a more footgun-y cryptographic tool than the one that: * defaults to unauthenticated encryption * buries its one authenticated mode * requires explicit command-line nonces * defaults to an MD5 KDF You could probably keep going for another 10 bullets. Never use the OpenSSL CLI for anything other than TLS stuff.
Yeah, the OpenSSL CLI sucks. So what's to be done? Sure, we can build a 25519-specific tool with a less footgun-y interface. Fine, whatever, for that one use case. Or we can build an alternative OpenSSL CLI that explodes OpenSSL and its numerous useful features in a general way and helps fix lots of use cases.
Nothing is to be done. Just don't use the OpenSSL CLI. It's a deeply cursed concept for a tool!
Re: Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)
#16(2024) My favourite part of these tools is the zany use of numbered file descriptors. `keypair` outputs the public key on fd 5 and secret key on fd 9. But signing reads the secret key on fd 8, while verification reads the public key on fd 4! Why aren't they the same?? I have to read the manpage every time.
What a strange convention. I'm partial to minisign, which works on plain old files.
Re: Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)
#17(2024) My favourite part of these tools is the zany use of numbered file descriptors. `keypair` outputs the public key on fd 5 and secret key on fd 9. But signing reads the secret key on fd 8, while verification reads the public key on fd 4! Why aren't they the same?? I have to read the manpage every time.
What a strange convention. I'm partial to minisign, which works on plain old files.
This little CLI is not meaningfully an alternative for signify/minify. Here's a good piece on signify from its author (who also comments here):
Re: Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)
#18(2024) My favourite part of these tools is the zany use of numbered file descriptors. `keypair` outputs the public key on fd 5 and secret key on fd 9. But signing reads the secret key on fd 8, while verification reads the public key on fd 4! Why aren't they the same?? I have to read the manpage every time.
[dead]
Re: Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)
#19Earlier quoted context omitted.
Yeah, the OpenSSL CLI sucks. So what's to be done? Sure, we can build a 25519-specific tool with a less footgun-y interface. Fine, whatever, for that one use case. Or we can build an alternative OpenSSL CLI that explodes OpenSSL and its numerous useful features in a general way and helps fix lots of use cases.
Nothing is to be done. Just don't use the OpenSSL CLI. It's a deeply cursed concept for a tool!
[dead]
Re: Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)
#20Sounds like the perfect place to embed credential stealing malware. Good thing they publish their code on an independent third-party public code sharing platform. Oh wait...