OpenKeychain VS age

In addition to my PC set up I am also using the Android Password Store in combination with OpenKeyChain. Everything works fine except that decrypting any password simply works without requiring my PIN. I've tried both USB C connection and NFC and neither interface requires the PIN.

OpenKeychain is an Android app for doing some basic GPG related work. It can verify signatures (hidden in the "encrypt/decrypt" menu)

Also it integrates i.e. with K-9 mail to sign and verify.

https://github.com/open-keychain/open-keychain

I don't know what features you are looking for in encryption software but OpenKeychain is foss, audited and works just fine if you just want basic encryption/decryption/signing.

OpenKeychain: Easy PGP (version 5.8.0): Encrypt your Files and Communications. Compatible with the OpenPGP Standard.

I use mailbox.org with the encrypted inbox, Mozilla Thunderbird on desktop, and FairEmail + OpenKeychain on Android. I think StartMail is the only other one of those four options that supports standard IMAP and SMTP.

On Android OpenKeychain, TermBot, and K-9 Mail, are awesome.

I would try openpgp, you can use https://www.gpg4win.org/ on windows and https://github.com/open-keychain/open-keychain (not actively developed, if someone knows a good alternative please comment) for android.

Openkeychain is a good gnupg encryption tool for Android. https://www.openkeychain.org/. It mostly is for using gnupg for email encryption, but you can also use it for file encryption too.

I think it's pretty clever, and demonstrates something very powerful about GitHub's position as de facto global code repository: you can get a strong cryptographic identity for (almost) anyone on the service, which you can then sign/encrypt to, verify for, etc.

age (another tool of Filippo's) leverages this to make encrypting to any GitHub user easy[1].

[1]: https://github.com/FiloSottile/age#encrypting-to-a-github-us...

`age` is a file encryption tool that is much more GPG. See https://github.com/FiloSottile/age

Since I'm starting to purge gpg out of my life, but do depend on it heavily for keeping my org notes and authinfo encrypted, I needed an epa/epg-style transparent encryption support for age (https://github.com/FiloSottile/age). As such I ported the relevant epa/epg code and reworked it to work with age.

age in question, in case you were as confused as I was by what that means: https://github.com/FiloSottile/age

> I don't think age does any real password extension.

Did you even bother to check?

https://github.com/FiloSottile/age/blob/main/scrypt.go

This isn't exactly hidden.

I left Google in May, where I was the lead of the Go Security Team. I am now a professional independent Open Source maintainer and amongst other things I work on the crypto in the Go standard library and in golang.org/x/crypto, including ciphers and "fun" elliptic curve implementations. I made tools like mkcert and age. I write a newsletter and I post on Mastodon. I have opinions on PGP and crypto APIs. I made the Heartbleed test once upon a time. I'm Italian and firmly anti-fascist.

If you want to encrypt any file, I can highly recommend age tool,

GNU pass, encryption with age key stored on a yubikey, and stored on a private git repo (native feature of pass)

I like the fact that your script is simple, and uses a ubiquitous library! But I do have a few suggestions:

1. You may be using an older version of openssl, but with modern versions, add the `-pbkdf2` option for much saner key derivation.

2. With modern versions of openssl, the `-salt` option is on by default, so you don't need to specify it explicitly (and you almost certainly want this option on, versus not using a salt or generating one yourself).

3. Since no AEAD modes are available with this tool, CTR mode (the `-aes-256-ctr` option) might be the best mode to use with AES (see https://security.stackexchange.com/questions/27776/block-cha...).

4. Alternatively, you might prefer to use ChaCha20 (the `-chacha20` option) over AES (see https://crypto.stackexchange.com/questions/34455/whats-the-a...).

So I would suggest this for the encryption command (instead of `openssl enc -aes-256-cbc -salt -a`):

> openssl enc -chacha20 -pbkdf2 -a

Also, instead of using openssl, you might prefer to use `age`, as it uses modern crypto best practices by default (see https://age-encryption.org/). With it, you could substitute this encryption command for the above:

> age -p -a

But if you need to send an encrypted message to someone who will not be able to reply (but whose public key you already have), you can't use Diffie-Hellman. PGP used to be the way to do this, but it's gotten quite old, Age encryption is a good modern program targeted to this sort of use-case. It's important to keep in mind here that without Diffie-Hellman, you have no forward secrecy, meaning all encrypted messages are sent to the same key which can all be decrypted if that key is later compromised.