rage

I'm not convinced that whole-disk encryption is sensible for most threat models, but I use the built-in FileVault on macOS (under the reasoning that, at the very least, it can't really hurt). On Linux, I use age[1] (specifically, rage[2]) to encrypt sensitive files. I wrote a secret manager that uses the latter as an encryption backend[3], and I use `rage-mount` to mount (read-only) views of encrypted archives. [1]: https://github.com/FiloSottile/age [2]: https://github.com/str4d/rage [3]: https://github.com/woodruffw/kbs2

There's also a rust version. https://github.com/str4d/rage

Yes! That’s what the plugin system is designed for. https://github.com/str4d/age-plugin-yubikey is fairly mature and I use it every day. Currently it's only compatible with https://github.com/str4d/rage, because age only supports plugins in a branch, but I'm hoping to land support this week!

https://github.com/str4d/age-plugin-yubikey is very much trying to beat GnuPG for ease of use and performance in that setup :) Currently it's only compatible with https://github.com/str4d/rage, because age only supports plugins in a branch, but I'm hoping to land support this week!

Hello! age (https://age-encryption.org) author here. Different tools can definitely be better for different use cases (for example I am a fan of restic [0] for backups, although age is designed to compose well with tar, if that's your thing), but do you mind me asking what made that tool feel more well defined than age? age has a stable spec [1] and an alternative implementation in Rust [2] based on the spec with extensive interop tests. If that’s just not visible, I’d be interested in how to fix that appearance, too! [0]: https://words.filippo.io/restic-cryptography/ [1]: https://age-encryption.org/v1 [2]: https://github.com/str4d/rage

I'd generally look at anything like this as a code smell. If you're looking for simple file encryption in Rust, and you'd consider doing something as bespoke as this, just use `rage` (and its `age` crate). As a bonus, you get interop with Go (the reference implementation of age is in Go). https://github.com/str4d/rage Having said this, I want to put a word in for a design change I think all of these tools should consider: don't accept user-provided passphrases by default. Instead, generate passphrases for the user, with a wordlist and entropy target. Encrypting programs can still accept a (bad) passphrase with an option! But it shouldn't be the default behavior.