Don't use this.
It's missing a basic building block: authentication.
Unfortunately, the author hasn't spent long enough researching cryptography. (Even the briefest of research would have made this mistake obvious.)
It's missing a basic building block: authentication.
Unfortunately, the author hasn't spent long enough researching cryptography. (Even the briefest of research would have made this mistake obvious.)
I have been planning to look into authentication. I didn't need it for my use cases, yet, but as you say that should be an integral part of any serious tool. I added a ticket: https://codeberg.org/ezcrypt/ezcrypt/issues/3
In the meantime, signing and verification can be done separately, e.g. with ssh-keygen, although that is a bit inconvenient (which kind of defeats one of the key points of the tool).