Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opmsg – A GPG Alternative

github.com

Post reply on HN
Print view View original

11–20 of 100 posts

Re: Opmsg – A GPG Alternative

#11

Post by mkesper »

lifeisstillgood wrote: post #9
mikorym wrote: post #6

I think a perhaps unclear part of the recent post "The PGP Problem" is that PGP is bad for email . If you don't use it for email, I don't see it as really a problem. Unless, maybe, you are a reporter or otherwise not clear on the principles behind using something like GPG. I think personally that the point about all the discussion is that for laypeople PGP and email is just too complicated (even for myself as a progr…

My understanding is quite different. Email is inherently insecure and there is nothing you can do about it. PGP is insecure for everything else as well The Latacora article was eye-opening for me on the email problem - quite simply if I send an encrypted mail to a friend / collegue - which I intend them to read, and they read it and quote it to someone else in plain text then that's it - my plaintext and my cipher ar…

Messages are encrypted with a session key in openpgp so this doesn't work.

Re: Opmsg – A GPG Alternative

#12

Post by lifeisstillgood »

mkesper wrote: post #11
lifeisstillgood wrote: post #9

Earlier quoted context omitted.

My understanding is quite different. Email is inherently insecure and there is nothing you can do about it. PGP is insecure for everything else as well The Latacora article was eye-opening for me on the email problem - quite simply if I send an encrypted mail to a friend / collegue - which I intend them to read, and they read it and quote it to someone else in plain text then that's it - my plaintext and my cipher ar…

Messages are encrypted with a session key in openpgp so this doesn't work.

How do I negotiate a session key with the email recipient? it's a single transmission? otherwise it's a one time pad perhaps - but then that defeats the point of the public key ?

would you mind expanding on this as it is an interesting area

Re: Opmsg – A GPG Alternative

#14

Post by blattimwind »

lifeisstillgood wrote: post #12
mkesper wrote: post #11

Earlier quoted context omitted.

Messages are encrypted with a session key in openpgp so this doesn't work.

How do I negotiate a session key with the email recipient? it's a single transmission? otherwise it's a one time pad perhaps - but then that defeats the point of the public key ? would you mind expanding on this as it is an interesting area

A random key is used to encrypt the email, then that random key is asymmetrically encrypted using the recipient's public RSA key. You do not use your own key to encrypt mails to someone else. Indeed, you can send encrypted emails without even having a key of your own.

Re: Opmsg – A GPG Alternative

#15

Post by wongarsu »

cwyers wrote: post #2

I am not qualified to review how it implements forward security, for instance. But this shares a lot of the problems that GPG has. It relies on existing mail standards, so it leaks metadata all over the place, and security can easily be defeated by "accidentally replying without encrypting." It's configurable -- every choice you have to make is a chance to make the wrong one. It implements RSA, which nobody should be…

>It implements RSA, which nobody should be using anymore

Can someone elaborate a bit? My impression was that RSA is fine with long keys, elliptic curves mainly provide shorter keys, and no decent quantum resistant algorithm emerged?

Re: Opmsg – A GPG Alternative

#16

Post by kzrdude »

wongarsu wrote: post #15
cwyers wrote: post #2

I am not qualified to review how it implements forward security, for instance. But this shares a lot of the problems that GPG has. It relies on existing mail standards, so it leaks metadata all over the place, and security can easily be defeated by "accidentally replying without encrypting." It's configurable -- every choice you have to make is a chance to make the wrong one. It implements RSA, which nobody should be…

>It implements RSA, which nobody should be using anymore Can someone elaborate a bit? My impression was that RSA is fine with long keys, elliptic curves mainly provide shorter keys, and no decent quantum resistant algorithm emerged?

I'm just interested but it reminds me of https://facthacks.cr.yp.to/ which is a horizontal attack, finding the weakest keys in a big set of them, and batch factorization attacks. This seems more developed for RSA keys?

Re: Opmsg – A GPG Alternative

#17

Post by Avamander »

ape4 wrote: post #13

The "MITM on all HTTPS traffic in Kazakhstan" issue suggests that relying on STARTTLS for email encryption isn't that great.

To be fair e-mail is garbage trough-and-trough. You can't even use SNI, nothing cares about certificate validity, even less about Staple and CT.

Re: Opmsg – A GPG Alternative

#18

Post by zaarn »

wongarsu wrote: post #15
cwyers wrote: post #2

I am not qualified to review how it implements forward security, for instance. But this shares a lot of the problems that GPG has. It relies on existing mail standards, so it leaks metadata all over the place, and security can easily be defeated by "accidentally replying without encrypting." It's configurable -- every choice you have to make is a chance to make the wrong one. It implements RSA, which nobody should be…

>It implements RSA, which nobody should be using anymore Can someone elaborate a bit? My impression was that RSA is fine with long keys, elliptic curves mainly provide shorter keys, and no decent quantum resistant algorithm emerged?

RSA is hard to implement and requires a lot of key material to change hand.

On the flipside, a Ed25519 or Ed448 key can be reasonably dictated over phone (though you might need three minutes) and put into small low-res QR codes.

Additionally, Ed25519/448 are dead simple to implement; following the reference from the RFC documentation, you can implement a safe cryptographic method (encrypt/decrypt/sign/verify). You actually have to go out of your way and do things the standard doesn't include to make it unsafe.

Compare with RSA, where such a naive implementation will make you suffer through atleast 30 CVEs of the "padding oracle" or "leak private key" type.

While RSA is fine from a mathematical standpoint, Ed25519/448 are much simpler to implement with much less code and are designed to be reasonably safe. They provide the same security as a ~3500 bit (or about 4500 bit for 448) RSA key, so it's on the safe side of things.

There is no Post-QC algorithm yet, atleast none that made it through the NIST competition, some of them do involve using RSA with absurd key sizes and they'll likely fail the competition.

Re: Opmsg – A GPG Alternative

#19

Post by masklinn »

wongarsu wrote: post #15
cwyers wrote: post #2

I am not qualified to review how it implements forward security, for instance. But this shares a lot of the problems that GPG has. It relies on existing mail standards, so it leaks metadata all over the place, and security can easily be defeated by "accidentally replying without encrypting." It's configurable -- every choice you have to make is a chance to make the wrong one. It implements RSA, which nobody should be…

>It implements RSA, which nobody should be using anymore Can someone elaborate a bit? My impression was that RSA is fine with long keys, elliptic curves mainly provide shorter keys, and no decent quantum resistant algorithm emerged?

https://blog.trailofbits.com/2019/07/08/fuck-rsa/ covers that.

The executive summary is that while it's possible to implement and use RSA properly:

* it looks easy to implement so it's common for people to roll their own (and then it's insecure or broken), ECC look hard (though aren't necessarily) so devs are more likely to use properly vetted libraries

* because most of the parameters must be kept secret, good advice is hard to find (and good parameter selection is absolutely critical), not to mention e.g. good exponents has complexity and performance implications[0], ECC parameters are public and you can pick existing good ones.

[0] and security grows sub-linearly with parameter size: 2048-bit RSA has 112 bits of security, 4096-bit RSA has 140 bits of security

Re: Opmsg – A GPG Alternative

#20

Post by lifeisstillgood »

blattimwind wrote: post #14
lifeisstillgood wrote: post #12

Earlier quoted context omitted.

How do I negotiate a session key with the email recipient? it's a single transmission? otherwise it's a one time pad perhaps - but then that defeats the point of the public key ? would you mind expanding on this as it is an interesting area

A random key is used to encrypt the email, then that random key is asymmetrically encrypted using the recipient's public RSA key. You do not use your own key to encrypt mails to someone else. Indeed, you can send encrypted emails without even having a key of your own.

So I actually re-read and followed links (I mean whats wrong with lazy assumptions anymore)

tptacek's "why email is insecure" post is here: https://news.ycombinator.com/item?id=16088386

And yes thats what he says in the original latacora post.

I read the article '''invariably CC the quoted plaintext of your encrypted message to someone else (we don’t know a PGP email user who hasn’t seen this happen)'''

So I made the (incorrect) leap to pgp using the long term key to encrypt files. My bad.

But this does not fix the original point it seems - email is not going to be "secure" any time soon. But you can send encrypted files over email to people.

Post reply on HN