5 ms·
Genuinely ignorant here and curious, would using OpenSSL’s salt option help here? I’m not quite sure why the instructions in the repo specify a fixed IV to begi
by philplckthun 6y ago
Genuinely ignorant here and curious, would using OpenSSL’s salt option help here? I’m not quite sure why the instructions in the repo specify a fixed IV to begin with
- rakoo 6y agoJust don't use openssl's command line for encrypting anything, there are better tools for that. My guess is that the fixed IV is used because the IV is needed for decrypting, which means either you prepend the ciphertext with it (which means you need to buffer the whole ciphertext in memory, defeating the streaming functionality of the service) or you already know it because it's hardcoded. In any case there is no authentication of the encrypted payload, so you have no idea if what you received really is encrypted by the person that claims to be the sender or if it was modified somewhere in the middle.
- gruez 6y ago>which means you need to buffer the whole ciphertext in memory, defeating the streaming functionality of the service Can't you generate an IV, write it out to the stream, then encrypt/write the ciphertext?
- LeoPanthera 6y agoYou can specify an IV with -iv. If you don't, the IV is derived from the password.
- rakoo 6y agoYou could indeed, I didn't think of that. But it starts to beheavier and heavier, and the risk of making subtle mistakes increases. That's why it's better to use tools that do it properly, like age (https://github.com/FiloSottile/age https://github.com/FiloSottile/age)
- ta17711771 6y agoJust don't use OpenSSL for anything - how many times does the community have to be burned by the same project before they switch?
- cjones26 6y agoWhat's a good alternative?
- ta17711771 6y agolibressl is the only one I'm aware of.