Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bruce Schneier has changed his PGP key to 4096 bits

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 144 posts

Re: Bruce Schneier has changed his PGP key to 4096 bits

#131

Post by Torgo »

rdl wrote: post #86
Torgo wrote: post #78

Earlier quoted context omitted.

I don't even know if common linux distributions even support the right combination of drivers and gnupg to even support 4096-bit RSA keys. I tried this a couple of times over the last two years or so, and there was always some bug, or it was fixed in a later version not in the repos yet.

I'm on OSX, and macports gpg does 4096 fine (gpg (GnuPG) 1.4.13). Also works fine on Ubuntu (gpg (GnuPG) 1.4.11) What no one seems to support is ECC, but until I get more confirmation, I'm inclined to follow Schneier and stick to 4096 RSA in preference to ECC, at least where possible. I really don't want my key to be on my general-purpose machine. I have fully airgapped machines for code signing and such, but for reg…

The bug in question was the interaction between the GPF cryptostick and 4096-bit RSA keys. You could create them, put them on the stick, but trying to verify signatures had a bug. I believe it's fixed

I can confirm the German Privacy Foundation PGP stick does NOT support ECC.

You might talk to the GPF, they are currently working on their next version of their cryptostick, and it's supposed to have encrypted USB storage and the ability to support applets.

Re: Bruce Schneier has changed his PGP key to 4096 bits

#133

Post by vabmit »

fdej wrote: post #117
vabmit wrote: post #104

Earlier quoted context omitted.

Lenstra et al performed the factorization you cite, again on CPUs. Lenstra said in 2007 that he expected with in 5 years to be able to do 1024bit number - again with CPUs. 2048bit is no where near 10^12 harder if you use GPUs with larger word/op/register sizes. That's especially so with FGPAs/custom hardware with custom sized words/registers/ops. With FGPAs and custom hardware you can also locate things physically in…

10^12 is how much more work you have to do (according to the complexity estimate for the GNFS), regardless of how you do that work. If your custom-built hardware is 10^12 times faster than a general-purpose CPU, you can factor a 2048-bit number on your hardware as fast as a 768-bit number on general-purpose CPUs, but it will still take 10^12 times more work than factoring a 768-bit number on the same hardware. And I'…

I think you're confusing complexity with difficulty. It may be 10^12 times more complex. But, if you're making your own FGPAs or chips and you can just use different word sizes or massively add more gates or processing cores. Or, even more specialized custom built super computers. The capabilities of what they're able to fabricate I think mitigate most of the protection provided by using 2048bit over 1024bit. It seems you need to be talking on the scale of at least 4096bit before the problem becomes intractable due to the limits of technology and the processing improvements that can be provided by custom hardware.

To put it in simple terms, doing operations with a 32bit numbers and a 64bit numbers have a calculable complexity gap. But, that gap means very different things in terms of difficulty on a 8bit microprocessor vrs a 32bit microprocessor vrs a 64bit microprocessor.

Re: Bruce Schneier has changed his PGP key to 4096 bits

#134

Post by leot »

IgorPartola wrote: post #126
leot wrote: post #69

Earlier quoted context omitted.

Webmail services could have jump-started WoT a decade ago, much like Hotmail jumpstarted popular email usage. [1] Had they "turned on" PGP for all their users, and then made it easy to tell when messages were being sent securely and when they weren't, it would have completely (and for the better) changed how we interact online (e.g., no need to "sign up" for web services, or "sign in" to every single site we visit; a…

Webmail + PGP really is insecure. The only way to do it properly would be with some OSS plugin + completely separate process for actually reading/writing emails. However, I think we could use a better way to associate emails with PGP keys. For example, my email uses a domain I own. I have HTTPS on my domain, so I can deliver my public key to you securely over the Web. Alternatively, Google could have a service where…

There are two concerns:

1) Security of email messages in transit, assurance that you're receiving emails from the person who claims to be sending them, etc.

2) Preventing your email service provider (and any MITM) from reading your emails.

These concerns are relatively independent of each other. While if you're a die-hard PGP advocate you'll want both 1 and 2, PGP-in-Gmail gives us 1, and that's a pretty great start.

Right now we have neither, and we're all much poorer for it.

PGP-in-Gmail instantly gives it to everyone that has an @gmail account (and anyone else who has signed up to a WoT). It would probably insist that you use two-key authentication. And it would work like this

0) Every message you send is automatically signed by you by default. 1) type in >=1 email addresses in To: bar 2) If all of the email addresses you sign have public keys associated with them that Gmail can locate, they all look "Green" (or whatever) and the [Send] button becomes [Send securely]. 3) If any of the addresses doesn't have a public key associated with it, then nothing is encrypted (i.e., exactly the behavior we have now).

If you don't trust Gmail, you shouldn't trust it any less if/when they deploy PGP for it. And no one is saying you have to use it. All I'm saying is that Gmail, Hotmail, etc. seem to be the best equipped to trigger the widespread adoption of PGP.

Re: Bruce Schneier has changed his PGP key to 4096 bits

#136

Post by a--b »

Qantourisc wrote: post #114
a--b wrote: post #81

I've been using 16,384 for my SSH key sizes for the past year and am considering using 32,768 a soon as my two year rotation period is up - would there be any problems with my key sizes?

Long key generation, longer login time, possible lack of a proper entropy in the key, if the entropy source is not good.

I'm okay with waiting, but the lack of entropy worries me a tad. Would that be super common with keys of that length? Thanks for the reply!

Re: Bruce Schneier has changed his PGP key to 4096 bits

#138

Post by Natanael »

leot wrote: post #134
IgorPartola wrote: post #126

Earlier quoted context omitted.

Webmail + PGP really is insecure. The only way to do it properly would be with some OSS plugin + completely separate process for actually reading/writing emails. However, I think we could use a better way to associate emails with PGP keys. For example, my email uses a domain I own. I have HTTPS on my domain, so I can deliver my public key to you securely over the Web. Alternatively, Google could have a service where…

There are two concerns: 1) Security of email messages in transit, assurance that you're receiving emails from the person who claims to be sending them, etc. 2) Preventing your email service provider (and any MITM) from reading your emails. These concerns are relatively independent of each other. While if you're a die-hard PGP advocate you'll want both 1 and 2, PGP-in-Gmail gives us 1, and that's a pretty great start.…

> If you don't trust Gmail, you shouldn't trust it any less if/when they deploy PGP for it.

The problem here might be that people (including Google, I guess) don't want users to trust anything MORE THAN THEY SHOULD, which is a major risk in a case like this. Sometimes security features can be counterproductive since they can lead to the users making bad assumptions and therefore bad decisions that they otherwise wouldn't have made. PGP in webmail implemented just in JS is likely one of these things that could make things worse due to how users treat them.

Re: Bruce Schneier has changed his PGP key to 4096 bits

#139

Post by Natanael »

reeses wrote: post #97
vabmit wrote: post #6

An interesting thing to note about 4096bit RSA openPGP keys, that's what Snowden was using. His PGP Key was a 4096bit RSA signing key with a 4096bit RSA encryption subkey.

I suspect that it's because 4096 is the largest permitted RSA key on most software right now. There is no 11 on that dial.

Some allow larger keys. I once generated an 8192 bit key. It took a loooong time. Never used it. I guess that piece of software would have allowed 16k keys too.

Re: Bruce Schneier has changed his PGP key to 4096 bits

#140

Post by anonymouz »

IgorPartola wrote: post #126
leot wrote: post #69

Earlier quoted context omitted.

Webmail services could have jump-started WoT a decade ago, much like Hotmail jumpstarted popular email usage. [1] Had they "turned on" PGP for all their users, and then made it easy to tell when messages were being sent securely and when they weren't, it would have completely (and for the better) changed how we interact online (e.g., no need to "sign up" for web services, or "sign in" to every single site we visit; a…

Webmail + PGP really is insecure. The only way to do it properly would be with some OSS plugin + completely separate process for actually reading/writing emails. However, I think we could use a better way to associate emails with PGP keys. For example, my email uses a domain I own. I have HTTPS on my domain, so I can deliver my public key to you securely over the Web. Alternatively, Google could have a service where…

> However, I think we could use a better way to associate emails with PGP keys. ... > Alternatively, Google could have a service where you securely ask it "what is the key for example@gmail.com" and it responds with the key

There is the PGP global directory which does essentially that (i.e., given an email address provides a key for with the email address verified by sending an email there... which is as good as what Google would be able to provide).

Doesn't seem to get much more use either way: I don't think the problem with driving up PGP adoption is the distribution of public keys.

Post reply on HN