Age vs GPG

[kotodharma]

This looks like a very nice little tool, the sort I would like to adopt. I have a simple encryption workflow that I use on an almost daily basis, for which I've been using GnuPG with symmetric crypto (gpg -c) for many years. Can you "sell" me age for this and other basic crypto needs, elevator-pitch style? Although I'm willing to believe it is better than gpg in many ways, switching from a major project which is likely to survive to one which may or may not still be developed in 5 years presents a small risk. What are the marquis advantages? How about the security of the respective ciphers used? I'm a software dev and Gentoo Linux user who tries his best to be an armchair security wonk, although it's hard work :) Thanks.

[cipriancraciun]

[I am not an age developer, nor am I a cryptographer; however I am a long time GnuPG user, and follow closely age and other applied cryptography related subjects. Thus take my response as mainly a personal, somewhat informed, opinion.]

---

The main difference between GnuPG and Age is simplicity (or complexity if you will):

• the file-format used is much simpler in Age than the one used by GnuPG (namely OpenPGP) which is quite complex because it has to support many use-cases and a lot of legacy; see RFC 4880 compared to age v1;

• the cryptography suite is very "opinionated" in Age (a single algorithm per purpose, mainly ChaCha20 and Curve25519, both developed by Daniel J. Bernstein), while GnuPG (because it has to implement OpenPGP) it supports quite a wide range of algorithms (some of witch are not quite "modern" and might have weaknesses); thus when using GnuPG, especially with sensitive data, one has to be aware what actual algorithms are used;

• (somewhat related to the previous point) the available cryptographic parameters (algorithms, strengths, rounds, key sizes, etc.) are chosen by the Age developers based on common best practices, meanwhile in GnuPG (due to the OpenPGP support) one can pick-and-choose (thus most likely due to not knowing the implications weakening the encryption) and the defaults are much more "conservative";

• however, Age is a much younger design and implementation than GnuPG, which can be both an advantage (cleaner code, current best practices, current cryptography, etc.) but also a disadvantage (less reviews and audits that might have discovered potential issues;) (for example GnuPG tries to make sure that the cryptographic material, i.e. the secret key bytes, are not leaked to swap by using memory locking through mlock on Linux; searching Age's issues and code for mlock or secure memory or memory locking doesn't yield anything;)

• one major advantage that GnuPG has (which keeps me personally trapped) is the existence of the gpg-agent that caches the secret key material so I can execute multiple encryptions / decryptions without providing the password multiple times (or using a password-less identity file);

• obviously Age only supports encryption / decryption, but GnuPG supports also signatures; (for this use-case one could use minisign built in a similar manner to Age;)

---

Regarding your question related to the security of the Age's cipher suite, as said Age uses (based on the specification):

• ChaCha20-Poly1305 (RFC 7539) (developed by D.J. Bernstein) -- used for encrypting the actual data (both for password based and private/public key modes);
• X25519 (RFC 7748) (developed by D.J. Bernstein) -- used for private/public key encryption;
• scrypt (RFC 7914) -- used for password derivation;
• HKDF-SHA-256 (RFC 5869) -- used for various keys derivations (not passwords);

Thus all algorithms are RFC based (and as such at least sound for the purpose), and all are "modern" in the sense that the community doesn't recommend moving from them to better alternatives. (The only slight exception is perhaps scrypt where there is push towards Argon2.)

The other important observation is that both ChaCha20-Poly1305 and X25519 were developed by D.J. Berstein, and both of these seem to be the "favorite" ciphersuites for many current open-source projects. (Although cryptography is not a popularity contest.) :)

---

Have / will I switch from GnuPG to Age?

For the moment I've stayed with GnuPG. For a single use-case I've already used Age, and were it not for the #256 issue (i.e. the inability of reading passwords from a file-descriptor) I would have migrated more use-cases towards Age (including decrypting the secret key for disk-encryption on my personal laptop).

At the moment Age is missing some UX-critical features (at least for me):

• it doesn't have an agent to cache the secret key material; (thus I'm left with repeated password entry or with password-less identity files;)
• it doesn't support reading the password from a file-descriptor; (the password is still provided somewhow, but in case of early Linux boot that has to be through systemd-ask-password;)

Also I'm still waiting on the fence to see how Age develops further. The initial apeal of Age over GnuPG (at least for me) was the simplicity: one binary to do all it supports, no configuration files, no $HOME mandatory; in recent months I've seen quite a lot mentioned "plugins" in the Age discussions, thus I'm afraid the GnuPG complexity will seap back in through these "optional plugins". (In fact the password from file-descriptor is hinted to be implemented as a "plugin", which for an early system boot use-case seems too convoluted.)

---

This is how I view and feel about Age. As said in the beginning, take this only as a personal, somewhat (mis?-)informed opinion. :)

[kotodharma]

Thank you, this is very helpful.

[oscar230]

Thank you!