Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Modern Alternatives to PGP

blog.gtank.cc

Post reply on HN
Print view View original

171–180 of 261 posts

Re: Modern Alternatives to PGP

#171

Post by kazinator »

tptacek wrote: post #120
kazinator wrote: post #91

> The "modern alternative" is to use a much more specific and much less configurable solution to your problem. The problem is you're replacing one configurable, flexible thing, with N different specific solutions involving multiple obscure little utilities. Oops! How can this blogger not see that this isn't better. How about a modern alternative to git? Instead of one hydra with so many heads, why not use scp for tra…

Because it is better. You don't get sound cryptosystems from configurable, flexible things; flexibility is the mortal enemy of cryptographic soundness. That's how "this blogger" "not see" that this isn't better. This isn't some fringe belief among hipster cryptography engineers (among which I'm sure George counts himself). You can read it straight out of _Cryptography Engineering_.

Was this reasoning true 25 years ago? If so, why don't we go back to RSA over DES3, with MD5 digests? All that dizzying proliferation of new crypto is wrecking the soundness.

Re: Modern Alternatives to PGP

#173

Post by helper »

kingofhdds wrote: post #151
lixtra wrote: post #128

Earlier quoted context omitted.

Magic Wormhole looks neat and I can imagine using it. But apparently it requires: - both parties to be online at the same time - have access to a secured channel to transfer the secret - Transfer a new autogenerated secret for each file transfer. PGP lets you: - verify the key once - re-use the key - the key be submitted through a public channel - the verification be done in a public (though tamper proof) channel or…

Also magic-wormhole relies on a hardcoded intermediary servers for which author gives no guarantees.

Its not hardcoded, its just the default server. You can specify your own via a cli flag.

Re: Modern Alternatives to PGP

#174

Post by lotharrr »

throwaway415415 wrote: post #149
gtank wrote: post #105

Earlier quoted context omitted.

It’s enough because of the underlying PAKE technique. The passwords do not directly become the key, and an unsuccessful bruteforce attempt breaks the session. PAKE isn’t really new, but it’s certainly underused for how much it changes the password game: https://blog.cryptographyengineering.com/2018/10/19/lets-tal...

The server can still bruteforce it though right?

(author of magic-wormhole here)

Nope, the server gets no more power than a random network attacker. The codes are single-use, enforced by PAKE, so an attacker (or the server) gets at most one chance to guess the code for any single execution of the program.

Re: Modern Alternatives to PGP

#175

Post by lotharrr »

jrochkind1 wrote: post #92

A side issue, but: > It generates those passwords for you, and they're short, one-time-use combinations of three English words If an attacker knows the tool does this, doesn't this reduce the keyspace to crack to (number of words in an English dictionary)*3? Is that enough? Am I missing something? A very complete dictionary has around 170K words, let's generously assume the password generator is willing to use all of…

magic-wormhole uses a 256-word list, so the two-word default provides 16 bits of entropy. But the code goes into PAKE, not a symmetric encryption key, so an attacker only gets one shot to guess it (it's an interactive protocol, so they must commit to their guess in the first message, and don't discover whether they're correct or not until the second message).

It's basically spending interactivity (and single-use-ness) to buy adequate security for a short secret. Magic-wormhole is not useful for encrypting long-term data-at-rest (because the sender needs to stick around to perform the key-exchange protocol with the receiver), nor is it useful for encrypting data to multiple parties (because the code is single-use). But it's great for getting a single file to a single person, or to establish a full-strength session key for continued use later.

Re: Modern Alternatives to PGP

#176

Post by lotharrr »

throwaway415415 wrote: post #142
lixtra wrote: post #128

Earlier quoted context omitted.

Magic Wormhole looks neat and I can imagine using it. But apparently it requires: - both parties to be online at the same time - have access to a secured channel to transfer the secret - Transfer a new autogenerated secret for each file transfer. PGP lets you: - verify the key once - re-use the key - the key be submitted through a public channel - the verification be done in a public (though tamper proof) channel or…

This. If you share a temporary password through another secure channel, you can probably just share a symmetric key and then you don't need PAKE anymore. In some cases though, you might want to send yourself something from one device to the other, or you are talking to someone who's not really technical on the phone. About being online at the same time, I was under the impression that this wasn't a requirememt.

(author of magic-wormhole here)

To transfer a file, both parties do need to be online at the same time. The server (which I run) does not store the file's data: it stores tiny key-exchange messages until both sides manage to make a direct connection, but then the encrypted file data is sent from sender to recipient without being stored in the middle. So it doesn't replace email or an FTP server or some other asynchronous file-transfer service.

You're absolutely right that if you already have a secure channel, you can send a full-strength symmetric key that way (e.g. send a PGP key, or one of the alternatives in gtank's post). But PAKE enables using a low-bandwidth secure channel. I can easily read a magic-wormhole code like "4-purple-sausages" to someone over the phone or to the person sitting next to me, but I'd be hard pressed to dictate an entire 256-bit secret key correctly.

Re: Modern Alternatives to PGP

#177

Post by eropple »

throwaway415415 wrote: post #135
eropple wrote: post #100

Earlier quoted context omitted.

Hm. So you think that libsodium is going to dry up and disappear from the internet in "5 years' time"? Bear in mind that its first GitHub import was in 2013 and that it is used, and supported, by lil' guys like...uh...lemme look at this..."Google". While it's drying up and disappearing, is it going to take with it things like rbnacl which both use it transitively, package it for their environments, and also have some…

Did Tink rely on NaCl or libsodium?

http://google.github.io/tink/javadoc/tink/1.0.0/com/google/c...

Tink implements it, though it does not rely on it.

Re: Modern Alternatives to PGP

#178

Post by bmn__ »

tptacek wrote: post #160
tyingq wrote: post #126

Earlier quoted context omitted.

Okay, so "gpg -c" is better than other commonly installed command line tools for encrypting a file with password?

PGP, which is something you have to explicitly install, is a badly flawed way to encrypt files; it has a poor password KDF and you should look at how it authenticates data. Install something better.

Well, what is better? You're the expert, why aren't you telling us outright?

Re: Modern Alternatives to PGP

#179

Post by [deleted] »

_wldu wrote: post #152
tptacek wrote: post #39

Earlier quoted context omitted.

Yes, as the article says, it's a 1990s-style ultra-configurable do-everything design which, in practice, almost always gets deployed in a lowest-common-denominator set of constructions that are themselves mired in 1990s crypto. No modern cryptographic engineer looking at any problem PGP solves would design a system that looked like PGP. PGP used to make some sense as a simple at-rest storage format, but in the era of…

tptacek - What would you consider a good modern way to replace encrypting large text files to multiple PGP keys? That's my main automated use case for OpenPGP in Go. If there is a simpler, more modern way, I'd like to try it... thanks. Edit: We do this, then push the files to a S3 bucket and users can get the files and decrypt them without having to deal with remembering/forgetting static passwords.

[deleted]

Re: Modern Alternatives to PGP

#180

Post by bmn__ »

jamieweb wrote: post #115
zeveb wrote: post #63

Earlier quoted context omitted.

> If you own a domain and have a webserver running ssl you can distribute your public key in a secure manner. That means that I'd be trusting GUANG DONG CERTIFICATE AUTHORITY and every other CA not to issue a fraudulent certificate against my domain. I don't think that's very secure.

Use a CAA policy in your DNS to lock down the CAs that can issue for your domain, and then monitor for issued certificates with the certificate transparency logs. In modern browsers, certificates are not trusted if they're not CT-logged, so it's impossible for a fraudulent one to exist without you knowing about it (unless it was issued before these requirements were put in place in ~April 2018, but once all of those…

That still does not help against the GP's problem. The most practical – yet totally ridiculous – solution in 2019 is still: for each end user, for each browser, to delete all pre-trusted CAs, and reenable them one-by-one trust-on-first-use. In a few days to weeks, the user ends up with around six active CAs that are actually in use, instead of dozens inactive ones that are just a backdoor waiting to happen.
Post reply on HN