Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Modern Alternatives to PGP

blog.gtank.cc

Post reply on HN
Print view View original

51–60 of 261 posts

Re: Modern Alternatives to PGP

#51

Post by Quekid5 »

tptacek wrote: post #39
Quekid5 wrote: post #33

Earlier quoted context omitted.

Is OpenPGP considered 'legacy'? If so, why? I was under the impression that it's mostly that it's really hart to reliably support e.g. calling 'gnupg' (cmdline), gpgme (library), etc.? ISTR there was a company that's re-implementing the OpenPGP standard from scratch in a library-oriented-fashion, but for the life of me I can't remember their name... I don't disagree with the 'drop legacy' stance, btw, I'm just intere…

Yes, as the article says, it's a 1990s-style ultra-configurable do-everything design which, in practice, almost always gets deployed in a lowest-common-denominator set of constructions that are themselves mired in 1990s crypto. No modern cryptographic engineer looking at any problem PGP solves would design a system that looked like PGP. PGP used to make some sense as a simple at-rest storage format, but in the era of…

Fair enough, I suppose.

I'm not sure it's just me being behind the times, but it seems that quite a few of the ideas behind PGP (specifically: asymmetric encryption) aren't really being exploited seriously. Instead there's lots of halfhearted "oh, let's just encrypt thing X with a password stored in thing Y" where Y is presumably more 'secure'. This is a bit of a tangent, but I find it interesting and depressing that industry has learned very little, if anything.

Re: Modern Alternatives to PGP

#52

Post by WorldMaker »

diafygi wrote: post #34
NelsonMinar wrote: post #19

Earlier quoted context omitted.

Keybase is one version of a modern take on Web of Trust. https://keybase.io/

Keybase is centralized. The GPG keyserver pool is a decentralized gossip network of volunteer servers (I run one). https://sks-keyservers.net/status/

Depends on what you think of their Blockchain/Merkle tree work, though. The attestation chain that Keybase uses is a public merkle tree, and though currently built to be centrally signed, at the root level, still has some built in decentralized redundancy at the user/client level.

Interesting gray areas between easy determinations of whether or not something is centralized/decentralized or now.

https://keybase.io/docs/server_security

Re: Modern Alternatives to PGP

#53

Post by tptacek »

Quekid5 wrote: post #51
tptacek wrote: post #39

Earlier quoted context omitted.

Yes, as the article says, it's a 1990s-style ultra-configurable do-everything design which, in practice, almost always gets deployed in a lowest-common-denominator set of constructions that are themselves mired in 1990s crypto. No modern cryptographic engineer looking at any problem PGP solves would design a system that looked like PGP. PGP used to make some sense as a simple at-rest storage format, but in the era of…

Fair enough, I suppose. I'm not sure it's just me being behind the times, but it seems that quite a few of the ideas behind PGP (specifically: asymmetric encryption) aren't really being exploited seriously. Instead there's lots of halfhearted "oh, let's just encrypt thing X with a password stored in thing Y" where Y is presumably more 'secure'. This is a bit of a tangent, but I find it interesting and depressing that…

This article explicitly points out modern alternatives to PGP's clunky, 1990s implementation of asymmetric encryption.

But, tangentially, it's a bad idea to use asymmetric encryption when you don't absolutely need it. Modern symmetric AEAD ciphers, which are implicated in pretty much all serious public-key designs anyways, are safer to use that asymmetric cryptography.

Seeing a public key in a design that doesn't demand public keys is a cryptographic engineering code smell.

Re: Modern Alternatives to PGP

#54

Post by jakeogh »

resoluteteeth wrote: post #44
taeric wrote: post #41

Earlier quoted context omitted.

I feel like this is asking past the point. Without a web of trust, how are you securely signing? You can go with somewhat centralized trust, but that only gets you do far. Or, rather, that forces everyone to deal with that centralized source. Much like the web of trust.

If you own a domain and have a webserver running ssl you can distribute your public key in a secure manner. What situations are you encountering in 2019 where you really need a distributed web of trust?

It's almost like not needing to roll your own key distribution mechanism is a nice feature.

Re: Modern Alternatives to PGP

#55

Post by g45y45 »

A problem I have run into with x25519 and ed25519 is that in Nacl, both use different public key 'formats'. While they are the same curve, you cannot use an x25519 for signing (ed25519 only) and you cannot use an ed25519 for encryption. PGP allows binding encryption and signing keys together in a profile. So far I have not been able to 'bind' an ed25519/x25519 key in a similar configuration.

Re: Modern Alternatives to PGP

#56

Post by g45y45 »

g45y45 wrote: post #55

A problem I have run into with x25519 and ed25519 is that in Nacl, both use different public key 'formats'. While they are the same curve, you cannot use an x25519 for signing (ed25519 only) and you cannot use an ed25519 for encryption. PGP allows binding encryption and signing keys together in a profile. So far I have not been able to 'bind' an ed25519/x25519 key in a similar configuration.

My point is that you need to roll your own cryptosystem, whereas PGP, for all its flaws, is a working, IND-CCA2 secure cryptosystem (provided you use the correct primitives). This whole blog is justification for removing PGP from Golang stdlib. I dont agree with Valsorda deprecating this.

Re: Modern Alternatives to PGP

#57

Post by justincormack »

g45y45 wrote: post #55

A problem I have run into with x25519 and ed25519 is that in Nacl, both use different public key 'formats'. While they are the same curve, you cannot use an x25519 for signing (ed25519 only) and you cannot use an ed25519 for encryption. PGP allows binding encryption and signing keys together in a profile. So far I have not been able to 'bind' an ed25519/x25519 key in a similar configuration.

It is not recommended to use any keys for more than one purpose any more, this can allow attacks. So this is by design.

Re: Modern Alternatives to PGP

#58

Post by helper »

g45y45 wrote: post #56
g45y45 wrote: post #55

A problem I have run into with x25519 and ed25519 is that in Nacl, both use different public key 'formats'. While they are the same curve, you cannot use an x25519 for signing (ed25519 only) and you cannot use an ed25519 for encryption. PGP allows binding encryption and signing keys together in a profile. So far I have not been able to 'bind' an ed25519/x25519 key in a similar configuration.

My point is that you need to roll your own cryptosystem, whereas PGP, for all its flaws, is a working, IND-CCA2 secure cryptosystem (provided you use the correct primitives). This whole blog is justification for removing PGP from Golang stdlib. I dont agree with Valsorda deprecating this.

Its never been part of the stdlib, its part of x/crypto. They also aren't going to remove it, just deprecate it.

Re: Modern Alternatives to PGP

#59

Post by heyjudy »

tptacek wrote: post #2

The context for this is this Go project proposal: https://github.com/golang/go/issues/30141 Filippo proposes to deprecate (but not remove) Blowfish, archaic curves, CAST, MD4, RIPEMD160, TEA, Twofish, XTS, and OpenPGP from the Golang x/ libraries (which are "officially supported" but not part of the standard library. It's really heartening to see a project get serious about shedding legacy crypto.

Shedding? Why? The point of supporting "legacy" crypto is batteries-included and for many instances where it's vital for backwards interoperability. Makes me glad I left Go because the populist noobs have definitely taken over and ruined it with their toxic, myopic, fashionablism ideas.

Re: Modern Alternatives to PGP

#60

Post by ForHackernews »

lucb1e wrote: post #47

> No one was sending you encrypted emails anyway Guess what! Since I moved to Germany (from the Netherlands), I noticed that people send a lot of encrypted mail. Not random Germans, sure, but where in the Netherlands the security and broader hacker community was hard to convince, in Germany it's quite widespread. My colleagues (security firm) and friendly security firms (when we collaborate) expect nothing less, and…

> I wonder what it's caused by and how we can encourage it

Probably because many Germans have a relatively recent memory of the Stasi in the DDR.

Post reply on HN