I'd currently encrypt a stream by piping it through the following command:
openssl enc -aes-256-cbc -pass file:/[keyfile path]
Is there a reliable implementation of ChaCha20-Poly1305 that I can use instead?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Last I read
openssl enc specifically avoids providing a
AEAD cipher because they're worried about providing a footgun to inexperienced users. And rightfully so, if you were to pipe the decryption output somewhere that processes it (rather than a temporary file) you would be processing unauthenticated data, only verifying the authenticity after the damage has been done.
While it's possible to safely stream encryption, it is definitely not safe to stream decryption, so I expect you are unlikely to find such an implementation. If you do, expect it to be insecure.