[HN Gopher] Show HN: Ezcrypt - A file encryption tool (simple, s...
___________________________________________________________________
Show HN: Ezcrypt - A file encryption tool (simple, strong, public
domain)
Author : ezcrypt
Score : 18 points
Date : 2024-10-26 17:38 UTC (1 days ago)
(HTM) web link (codeberg.org)
(TXT) w3m dump (codeberg.org)
| forty wrote:
| This seem to use home made cryptography, which is never a good
| idea. In particular it's not clear why this design with layered
| algorithms is needed, nor why it uses a non standard KDF.
|
| Prefer using libsodium for the crypto, which has made sensible
| choices for you.
| forty wrote:
| Also you are missing a MAC, which is also a bad idea
| deknos wrote:
| what does this provide which cannot be done with openssl, which
| is available for most systems?
| cynicalsecurity wrote:
| OpenSSL should not be used for encryption of files. PGP/GnuPG
| should.
| max_ wrote:
| Why not?
| tptacek wrote:
| Last I checked, there's no authenticated encryption option
| in the OpenSSL CLI.
| tptacek wrote:
| No, PGP isn't much better.
| SahAssar wrote:
| How would you compare this to existing tools in the space like
| https://github.com/FiloSottile/age?
|
| Seems like age has multiple implementations (rust, go), has a
| permissive license, a public specification
| (https://github.com/C2SP/C2SP/blob/main/age.md) and the spec/core
| implementation is developed by someone with a history with
| cryptography (I don't know if you do, but there is no indication
| or name attached to the repo).
|
| While many things can be built as a hobby or learning project I
| feel like cryptography is one of those spaces where you should be
| clear if it is that and if it is not you need to expressively
| argue its bona fides up front.
| voodooEntity wrote:
| I recently gave building a file encryption tool a shot myself (
| https://github.com/voodooEntity/go-tachicrypt ) tho i didnt
| implement my own crypto to be fair.
|
| I think its always good to dive into topics if you are actually
| interested and lets face it, the beginning of most of the big
| things nowadays started somewhere in a basement or a garage.
| tptacek wrote:
| The code isn't especially easy to follow, but is this a cascade
| of Serpent, Twofish, ChaCha20, and AES, all in CBC except for
| ChaCha, without an authenticator? With its own stream
| construction, that doesn't stop truncation?
| dist-epoch wrote:
| PSA: it should be obvious that it's a really dumb idea to use
| random new encryption tools from GitHub (sorry, author)
| spease wrote:
| > it should be obvious
|
| It should be, but a lot of developers don't have formal
| security training, nor especially management which may end up
| selecting the contractors/developers and deciding on the
| technical approach.
|
| If it's explicitly not production ready, it should probably say
| so up front, not advertise itself as "strong encryption".
| However painful that may be.
| sevg wrote:
| Don't use this.
|
| It's missing a basic building block: authentication.
|
| Unfortunately, the author hasn't spent long enough researching
| cryptography. (Even the briefest of research would have made this
| mistake obvious.)
| everfree wrote:
| What's the advantage over symmetric PGP encryption?
___________________________________________________________________
(page generated 2024-10-27 23:01 UTC)