Comment by tptacek
7 years ago
Really, all I did here was combine posts from Matthew Green, Filippo Valsorda, and George Tankersley into one post, and then talk to my partner LVH about it. So blame them.
(also 'pvg, who said i should write this, and it's been nagging at me ever since)
The elephant in the room is "what to do about email", and a significant part of the issues are related to the "encrypt email" use case: part of the metadata leakage, no forward secrecy, ...
The closest advice to this in the article would be "use Signal" which has various issues of its own, unrelated to crypto: it has Signal Foundation as a SPOF and its ID mechanism is outright wonky, as phone numbers are IDs that are location bound, hard to manage multiple for a person, hard to manage multiple persons per ID, hard to roll over.
To me that seems to be a much bigger issue than "encrypting files for purposes that aren't {all regular purposes}".
Is it wrong to use openssl to encrypt files?
0. (Only once) generate key pair id_rsa.pub.pem, id_rsa.pem
1. Generate random key
2. Encrypt key
3. Encrypt file using key
-- other side --
4. Decrypt key
5. Decrypt file
from https://www.openssl.org/docs/man1.1.1/man1/openssl-enc.html
> The enc program does not support authenticated encryption modes like CCM and GCM, and will not support such modes in the future.
> For bulk encryption of data, whether using authenticated encryption modes or other modes, cms(1) is recommended, as it provides a standard data format and performs the needed key/iv/nonce management.
So don't use `openssl enc` to encrypt data.
`openssl cms` that is recommended above is S/MIME. Don't use S/MIME.
I can't wait for Filippo Valsorda's `age` to be done so I would have an answer to the question of "what should I use to encrypt a file?".
`enc` doesn't support and will never support _any_ authenticated ciphers. Consider it a red flag when you see it in the future.
https://github.com/openssl/openssl/commit/c03ca3dd090c6eb739...
To start with, none of that encryption is authenticated.
So if I understand you correctly (Noob here), Alice would need to sign the pair (key.enc, file.enc) to authenticate that those files originated from her.
Without that, Bob could potentially receive any pair of (key,file), which would just decrypt into garbage data.
BTW, variations on that sequence appear all over the internet when searching for "openssl encrypt file with public key"...
3 replies →
I've followed and enjoyed your commentary on PGP and cryptography in general, so I thought I'd post it.
Any idea when Fillipo's `age` will be done, or how to follow its development, other than the Google doc?
Filippo should get to work! The design part of age is the hard part; the actual programming is, I think? maybe one of the easier problems in cryptography (encrypt a single file with modern primitives).
I am a little bit giving Filippo shit here but one concern I have about talking "age" up is that I'm at the same time talking the problem of encrypting a file up more than it needs to be, so that people have the impression we'd have to wait, like, 5 years to finally see something do what operating systems should have been doing themselves all this time.
What are your thoughts on Keybase as a secure Slack replacement?
Personally, I love Keybase and it is my #1 choice for communicating with a few people, but bugs are far too frequent for me to consider it for a business.
It's getting better, but not close being business ready imo.
I've been using Wire on iOS, web, desktop (electron), and Android, and Keybase on Android and desktop (cli). Both are not great but Keybase is definitely the more buggy. Wire on Android, on the other hand, is also quite unusable due to its battery drainage. And both are pretty much unusable on desktop: Keybase is a CLI (not even a TUI) and Wire is Electron. I'd prefer a TUI over Electron but it's not even a TUI, so I guess Wire wins this round. Keybase also doesn't have a web client, which is why I have experience with the command line client. I think that says enough in and of itself.
What I'm trying to say is, definitely also try Wire as it's similar but slightly better. I also haven't figured out how to verify someone over Keybase, so it's basically unauthenticated or opportunistic encryption. By comparison, Wire is considered secure enough by my company after doing a pentest on it, which says quite something (most customer's stuff we would run from if we were thinking of using it), and we use it as our main communication platform within the company.
This is great, thanks for writing it!
Brings to mind the words of renowned Victorian lifehacker Jerome K. Jerome:
“I can't sit still and see another man slaving and working. I want to get up and superintend, and walk round with my hands in my pockets, and tell him what to do. It is my energetic nature. I can't help it.”