I've been using 16,384 for my SSH key sizes for the past year and am considering using 32,768 a soon as my two year rotation period is up - would there be any problems with my key sizes?
Bruce Schneier has changed his PGP key to 4096 bits
81–90 of 144 posts
Re: Bruce Schneier has changed his PGP key to 4096 bits
#82Re: Bruce Schneier has changed his PGP key to 4096 bits
#83So I have a GPG key. I used it a couple of times. Currently, it's most useful to me to sign my own Debian package repository. However, I can't seem to figure out how to get into the whole Web of Trust thing. Nobody I know has their own GPG/PGP key that they use and have signed by others and tools like BigLumber and other places where I looked for key signing parties have not turned up any results. I not spending all…
>perhaps we need a geolocation aware social network a la Square but just for notifying you of other nearby PGP users...
To what end though? What do you share in common with them other than the fact that you're both probably interested in cryptography? Just because you can easily communicate back and forth with encrypted messages doesn't mean you'll actually have much to talk about.
Re: Bruce Schneier has changed his PGP key to 4096 bits
#84Earlier quoted context omitted.
With linux, is there any way to compromise the USB stick used for the air gap? AFAIK the Stuxnet virus was originally spread via USB stick, however I reckon that it involved Windows machines that are known to execute files on USB sticks.
If you aren't 100% sure of the providence of your usb stick, you can't really rely on it for _anything_ – have you seen Travis Goodspeed's "Writing a Thumbdrive from Scratch" presentation? http://www.youtube.com/watch?v=D8Im0_KUEf8
Indeed! An intelligent "USB Device" is what was used to originally jailbreak the PS3. [0] A USB device (commonly using an AVR USB microcontroller) sends differing USB descriptors at different times - a sort of double-fetch vulnerability. The exploit leads to complete hypervisor access. Do NOT trust your USB device!
[0]: http://ps3wiki.lan.st/index.php?title=PSJailbreak_Exploit_Re...
Re: Bruce Schneier has changed his PGP key to 4096 bits
#85Well mine is 4097 bits. Checkmate, Sir.
Re: Bruce Schneier has changed his PGP key to 4096 bits
#86I wish there were a decent hardware PGP key token available now -- something which could support 4096 RSA and communicated via (ideally) BT but also acceptable USB to a host. The GPF stick is out of stock.
I don't even know if common linux distributions even support the right combination of drivers and gnupg to even support 4096-bit RSA keys. I tried this a couple of times over the last two years or so, and there was always some bug, or it was fixed in a later version not in the repos yet.
I'm on OSX, and macports gpg does 4096 fine (gpg (GnuPG) 1.4.13). Also works fine on Ubuntu (gpg (GnuPG) 1.4.11)
What no one seems to support is ECC, but until I get more confirmation, I'm inclined to follow Schneier and stick to 4096 RSA in preference to ECC, at least where possible.
I really don't want my key to be on my general-purpose machine. I have fully airgapped machines for code signing and such, but for regular communications, I want a key which can be used from my laptops (mac, ubuntu) and ideally from iOS/Android (via bluetooth), without being exposed to compromise on the host. You can force me to sign or decrypt arbitrary stuff while my key is paired, but can't steal my key.
Ideally v2 would have some kind of log of all transactions on the secure token, so I can at least see if I'm being trolled for signatures/decrypts by malware on the host, and in v3, some kind of secure UI on the device.
I figure I could make a device like this, in a fully open/auditable design, for <$250/unit. Ideally something which looks like the Blackberry CAC reader, but uses bt 4.0 le to talk to a paired host, rather than power-hungry bluetooth.
Re: Bruce Schneier has changed his PGP key to 4096 bits
#87So I have a GPG key. I used it a couple of times. Currently, it's most useful to me to sign my own Debian package repository. However, I can't seem to figure out how to get into the whole Web of Trust thing. Nobody I know has their own GPG/PGP key that they use and have signed by others and tools like BigLumber and other places where I looked for key signing parties have not turned up any results. I not spending all…
>perhaps we need a geolocation aware social network a la Square but just for notifying you of other nearby PGP users... To what end though? What do you share in common with them other than the fact that you're both probably interested in cryptography? Just because you can easily communicate back and forth with encrypted messages doesn't mean you'll actually have much to talk about.
I want people to sign my public key. I don't care who they are but the more people do the more people can trust that it really is my key. Imagine if your phone told you that you are at the same coffee shop as someone who is also a registered PGP user and has not yet signed your key. That would be pretty easy, right?
Re: Bruce Schneier has changed his PGP key to 4096 bits
#88An interesting thing to note about 4096bit RSA openPGP keys, that's what Snowden was using. His PGP Key was a 4096bit RSA signing key with a 4096bit RSA encryption subkey.
Do you have a source regarding the technical details of the Snowden leaks? Not doubting, I'm just interested in reading about it, nothing I've seen from The Guardian/NYT/WP covered this.
Re: Bruce Schneier has changed his PGP key to 4096 bits
#89Earlier quoted context omitted.
I met Bruce this last weekend at a conference, and every single business card I collected had the individual's PGP key on it.
Well, I'm a professional security researcher, and I end up using ZIP+AES more often than I do PGP.
How do you securely share the AES key?
Re: Bruce Schneier has changed his PGP key to 4096 bits
#90Earlier quoted context omitted.
With linux, is there any way to compromise the USB stick used for the air gap? AFAIK the Stuxnet virus was originally spread via USB stick, however I reckon that it involved Windows machines that are known to execute files on USB sticks.
Years ago, a classmate of mine built a rig out of a receipt printer and one of those old handheld scanners to provide an "air gap", though it never really worked (sort of an art project at the time). Might be time to revive the idea...
How about 2 serial ports, connecting only TxD, RxD and GND? 3-wire RS-232 basically has no attack surface, there's no protocol to speak of. [edit: shabble already suggested this]