Yahe

I will end the discussion here and just proceed to advise anyone who is asking against using ccrypt.

I still think that your FAQs are misleading. The answer to the question "We are thinking of using ccrypt in our company to encrypt our data. Is ccrypt still a strong encryption that is very hard to break?" should be a "No." The response to the question "Does ccrypt implement an authenticated encryption scheme to protect the integrity of the encrypted data? " implies that not providing integrity protection is not a big deal and your suggestion to add an outdated SHA-1 hash at the beginning of the...

Perhaps people expect the author of an encryption tool to provide a proper solution. I was personally asked by a colleague if it is okay to use your application and I had to advise against it. You expect end users to know their way around cryptography which is a false assumption.

This must be some kind of joke. This problem should be mentioned directly on the website and in the security section of the FAQs. Instead you hide this crucial information in the manpages in a section that starts with the false claim that "ccrypt is believed to provide very strong cryptographic security". Actually, I dispute this claim as providing integrity guarantees is part of providing very strong cryptographic security. As I see it right now, ccrypt is outdated cryptographic software that hides...

Missing integrity protection

@pbrunschwig Why is this bug considered "invalid" when the issue creator even recommended on how to improve the current situation? extensions.enigmail.autoWkdLookup seems to completely disable the WKD lookup which is not what the issue creator proposed.

We're currently rolling out WKD internally, but I get the same error for an already existing key that had been imported. What do I have to do to fix the problem behind this The key Foo Bar <foobar@example.com> does not have a WKS identity. message?