Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)

lib25519.cr.yp.to

Post reply on HN
Print view View original

31–40 of 61 posts

Re: Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)

#31

Post by yellowapple »

jedahan wrote: post #13
alexjurkiewicz wrote: post #2

(2024) My favourite part of these tools is the zany use of numbered file descriptors. `keypair` outputs the public key on fd 5 and secret key on fd 9. But signing reads the secret key on fd 8, while verification reads the public key on fd 4! Why aren't they the same?? I have to read the manpage every time.

I was wondering the same thing. My best guess is that is to guard against operator misuse. Like usb-a only plugging in one way. Anything that is secret will never accidentally print to stdout. String interpolation in bash with `—option $empty` might be safer than `8<$empty`. Have to explore more but yeah, this is a new pattern for me as well.

Another possible factor driving the decision to use numbered file descriptors: the logic to validate that a file exists (or can exist) at a given path, is readable/writable, etc. gets punted to the shell instead of being something the program itself has to worry about.

Re: Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)

#32

Post by C4K3 »

XorNot wrote: post #28
adastra22 wrote: post #26

Earlier quoted context omitted.

GPG is pervasive for the same reason git is pervasive: network effects. There are plenty of better alternatives.

Such as? I need an alternative which supports commutative trust relationships of some sort which are revocable.

Keybase or any of the tools inspired by keybase (foks.pub etc)

Re: Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)

#33

Post by gnull »

alexjurkiewicz wrote: post #2

(2024) My favourite part of these tools is the zany use of numbered file descriptors. `keypair` outputs the public key on fd 5 and secret key on fd 9. But signing reads the secret key on fd 8, while verification reads the public key on fd 4! Why aren't they the same?? I have to read the manpage every time.

That's such a user-hostile design decision. I can't fathom what justifies it (other than kinky taste).

Makes your commands unreadable without a manual, leaves a lot of room for errors that are quietly ignored. And forces you into using a shell that comes with its own set of gotchas, bash is not known to be a particularly good tool for security.

And to those who stay this adds flexibility: it doesn't. Those file descriptors are available under/dev/fd on linux, with named options you can do --pk /dev/fd/5. Or make a named pipe.

Re: Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)

#34

Post by tptacek »

why-o-why wrote: post #27
tptacek wrote: post #12

Earlier quoted context omitted.

If you mean the OpenSSL CLI, it's hard to think of a more footgun-y cryptographic tool than the one that: * defaults to unauthenticated encryption * buries its one authenticated mode * requires explicit command-line nonces * defaults to an MD5 KDF You could probably keep going for another 10 bullets. Never use the OpenSSL CLI for anything other than TLS stuff.

Are you confusing the open openSSL library with the CLI? Absolutely none of this is true when used as a signing tool on the CLI. Seems like you just needed to rant, rather than answer my question. Which is fine: I do it to, but I was legit asking a question that you ignored and you seem to know about openSSL?

[flagged]

Re: Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)

#35

Post by gnull »

jedahan wrote: post #13
alexjurkiewicz wrote: post #2

(2024) My favourite part of these tools is the zany use of numbered file descriptors. `keypair` outputs the public key on fd 5 and secret key on fd 9. But signing reads the secret key on fd 8, while verification reads the public key on fd 4! Why aren't they the same?? I have to read the manpage every time.

I was wondering the same thing. My best guess is that is to guard against operator misuse. Like usb-a only plugging in one way. Anything that is secret will never accidentally print to stdout. String interpolation in bash with `—option $empty` might be safer than `8<$empty`. Have to explore more but yeah, this is a new pattern for me as well.

Those descriptors like 5 could be mapped to anything, including descriptor 1, stdout.

Re: Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)

#36

Post by pseudohadamard »

alexjurkiewicz wrote: post #2

(2024) My favourite part of these tools is the zany use of numbered file descriptors. `keypair` outputs the public key on fd 5 and secret key on fd 9. But signing reads the secret key on fd 8, while verification reads the public key on fd 4! Why aren't they the same?? I have to read the manpage every time.

It's djb's web site so it's a djb design. With great genius comes great different thinking.

Re: Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)

#37

Post by alfiedotwtf »

alexjurkiewicz wrote: post #2

(2024) My favourite part of these tools is the zany use of numbered file descriptors. `keypair` outputs the public key on fd 5 and secret key on fd 9. But signing reads the secret key on fd 8, while verification reads the public key on fd 4! Why aren't they the same?? I have to read the manpage every time.

I’m guessing it’s to support the test framework it’s built with?

Re: Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)

#38

Post by why-o-why »

tptacek wrote: post #34
why-o-why wrote: post #27

Earlier quoted context omitted.

Are you confusing the open openSSL library with the CLI? Absolutely none of this is true when used as a signing tool on the CLI. Seems like you just needed to rant, rather than answer my question. Which is fine: I do it to, but I was legit asking a question that you ignored and you seem to know about openSSL?

[flagged]

[flagged]

Re: Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)

#39

Post by why-o-why »

tptacek wrote: post #22
quotemstr wrote: post #21

Earlier quoted context omitted.

A command like cryptography swiss army knife useful though. If not openssl, then what?

It's useful as a toy and a learning tool, but for nothing else. For those two things, OpenSSL is fine as it is.

[flagged]

Re: Ed25519-CLI – command-line interface for the Ed25519 signature system (2024)

#40

Post by PunchyHamster »

> It writes the public key to file descriptor 5, and then writes the secret key to file descriptor 9.

Is the project trying to compete with GPG for worst interface ? Magic numbers BAD, especially in something that will mostly be used in scripts

Post reply on HN