<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/xhtml; charset=utf-8">
</head>
<body>
<div style="font-family:sans-serif"><div style="white-space:normal">
<p dir="auto">On 1 Sep 2019, at 11:13, Brian Exelbierd wrote:</p>
</div>
<div style="white-space:normal"><blockquote style="border-left:2px solid #777; color:#777; margin:0 0 5px; padding-left:5px"><p dir="auto">[...] In theory an alternate program, using libsodium or whatever, that stored the shareable config (nonce, etc.) in the password repo and that used the same pinentry as GPG would go unnoticed by me.</p>
</blockquote></div>
<div style="white-space:normal">
<p dir="auto">Sure, if we re-implement the features currently being used from GPG, switching to an alternative would go unnoticed :)</p>
<p dir="auto">But that feature list also includes key management, for example teams may encrypt passwords for multiple recipients and/or with different keys for different sub-folders.</p>
<p dir="auto">So it is not trivial to re-implement these features, even if we rely on libsodium.</p>
<p dir="auto">And I do think that having a repository with .gpg files is better than custom .pass files, as many things can operate on .gpg files, where nothing (but a hypothetical <code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0 0.4em" bgcolor="#F7F7F7">pass</code> command) can operate on the latter, and it may not expose low-level commands to do the same operations that are currently possible to do with gpg.</p>
</div>
<div style="white-space:normal"><blockquote style="border-left:2px solid #777; color:#777; margin:0 0 5px; padding-left:5px"><p dir="auto">How is libsodium, or any other format, proprietary when compared to GPG? It seems they just have different formats which mean different programs can read them. It seems that just as a GPG encrypted file can be read on any machine with GPG installed, a libsodium encrypted file has the same properties.</p>
</blockquote></div>
<div style="white-space:normal">
<p dir="auto">Libsodium is a utility library and does not define any file formats, therefore using it would mean inventing our own file formats.</p>
<p dir="auto">You can argue that .gpg files are exclusive to the <code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0 0.4em" bgcolor="#F7F7F7">gpg</code> command, and I do not disagree, but I do think there is a difference, as <code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0 0.4em" bgcolor="#F7F7F7">pass</code> is not a utility to encrypt/decrypt files nor manage public/private keys, therefore it would be unlikely to expose the same operations as <code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0 0.4em" bgcolor="#F7F7F7">gpg</code> when it comes to operating on its data files, and in that sense, I would consider the data files proprietary to <code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0 0.4em" bgcolor="#F7F7F7">pass</code>.</p>
</div>
</div>
</body>
</html>