Use chacha20 without poly for more speed? Aka AEAD? about age HOT 2 CLOSED

Authenticated encryption is about defending the plaintext from oracle attacks, not about sender identity. Closing as a duplicate of #51.

from age.

After careful reading, I concede that age does not claim to provide authentication. To reiterate, currently age only provides unauthenticated streaming encryption. Internally it uses AEAD as an implementation detail to defend against a swath of attacks such as cyphertext malleability and oracle attacks, which does seem like a good thing.

An unauthenticated encryption still gives an attacker the opportunity to generate a valid encrypted stream of his choosing or replace it with another cyphertext and have you decrypt it.

Note however that I am not necessarily proposing sender identity verification or sender authentication. I am proposing data authentication, i.e. a tool that provides a reasonable authenticated streaming encryption. A means to reasonably bind an encrypted stream to something, to verify it is what it should be and not something else.

After rereading the referenced Streaming Encryption post, I have not identified a place where the author would be ok with unauthenticated streaming AEAD, preventing malleability etc. yet not stream replacement. On the other hand, in many cases it is very clear having an authenticated encrypted stream is actually the point.

from age.