Hacker News new | ask | show | jobs
by TedDoesntTalk 2369 days ago
meh.

https://stackoverflow.com/questions/16056135/how-to-use-open...

With that I'm guaranteed AES, a known-good encryption algorithm. I have no idea what these guys are doing without reading through their documentation. Hopefully they didn't roll their own.

3 comments

That command line doesn't even produce authenticated ciphertext. I'm amazed that's the check-marked best answer on Stack Overflow.
I have seen many questions on security stack exchange and /r/crypto where the correct answer should have been "use age", but because it didn't exist the correct answer was something bad. openssl CLI is not meant to be used in prod (both because not AEAD and because the man page tells you not to use it). gpg is bad. rolling your own CLI tool using libsodium is not for everyone.
https://twitter.com/pwnallthethings/status/12107355525357527...

I'd be nicer but for the "hopefully they didn't roll their own" at the end.

It's possible this is the wrong way to get AES on the command-line; I haven't done it and no need to right now. But that's missing my point entirely.
Your point is that you can do the wrong thing with OpenSSL so that means you don't need a tool that does the right thing?

That is not a solid point.

The point being?

You've linked to a command that's wrong, from a random internet "everybody gets to answer a question and everybody gets to vote for the best answer, no qualifications required" website, and wrote "with that I'm guaranteed AES, a known-good encryption algorithm" as if that means anything.

What you're linking has now literally been edited with an update to suggest the tool age.

The idea that "AES is enough" is like saying you don't need better winter clothes to go skiing because you have a good helmet. There's still more things left you need to protect than that! A secure block cipher mode and key management and IV generation, etc, is mandatory!