minisign VS hpenc

There are alternatives, minisign and signify.

You don't have to attach identities to public and private keys. If all you need it for is signing, then check out minisign.

If you need signatures, minisign is a similar hard-to-misuse program.

In your case, use a tool such as https://jedisct1.github.io/minisign/ to do signing/verification. GPG is another choice which is very common. It will produce a "signature" which can be embedded alongside your posts verifying that the text of the post was endorsed by someone bearing the given public key.

Claiming it's not ancient because Linux desktop distributions still use it for signing packages is a very odd argument. Most Cryptography experts (note: I'm not talking about programmers, IT professionals or people who know a thing or two about cryptography, I mean actual cryptographers) would agree that we should start using something like signify or minisign instead of the bloated mess that is GPG for signing package repositories.

minisign\ (5 comments)

How it different to alternative: hpenc ?

ChaCha20-Poly1305, great. Thank you, I was looking for the algorithm. Just found a similar tool in C++/libsodium yesterday called hpenc[1] that uses AES-GCM or ChaCha20 to encrypt files and streams. But this is even better as it's drop in, I don't have to worry about dependencies and it does much more.

https://github.com/vstakhov/hpenc