[gruez]

>which means you need to buffer the whole ciphertext in memory, defeating the streaming functionality of the service

Can't you generate an IV, write it out to the stream, then encrypt/write the ciphertext?

[rakoo]

You could indeed, I didn't think of that. But it starts to beheavier and heavier, and the risk of making subtle mistakes increases. That's why it's better to use tools that do it properly, like age (https://github.com/FiloSottile/age)

[LeoPanthera]

You can specify an IV with -iv. If you don't, the IV is derived from the password.