Is rclone's crypt remote as a restic backend a bad practic?

[fd0]

@eric

The replacement of GCM with Poly135 authentication in restic is certainly nonstandard.

I’m not sure what you mean with “replacement”, but you’re right: the combination is not standard.

I’ve written a bit about the crypto here: Crypto Design Decisions and Filippo had a brief look here.

@eric

Is there a reason for not using the standard encrypted authentication AES-GCM or ChaCha20-Poly135?

At the time the code was written (in 2014), it was the fastest way to do authenticated encryption in Go. It benefits from native instructions built into many CPUs to encrypt/decrypt with AES, and the fast speed achievable with Poly1305. It was before Go’s GCM implementation got fast.

If I were to reimplement the crypto I’d use something else.