Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Switching from GPG to Age

luke.hsiao.dev

Post reply on HN
Print view View original

111–120 of 148 posts

Re: Switching from GPG to Age

#111

Post by tptacek »

lrvick wrote: post #107
tptacek wrote: post #99

Earlier quoted context omitted.

No, I got the tldr of their point just fine. They're just wrong.

If I am wrong I challenge you to point at a well specified replacement for PGP with a diversity of competing implementations as a decentralized cryptographic identity and trust system for open source software supply chain signing, authentication, and peer to peer encryption with a variety of smartcard generation, usage, and backup solutions better for every situation PGP is used in today. Also a solution that signifi…

I'm not the one insulting Filippo Valsorda, for no apparent reason (any of your points could have been made without criticizing him), when he's not present to defend himself in this thread. The onus is squarely on you here. You won't succeed, though, so I don't blame you for not wasting the time.

Re: Switching from GPG to Age

#112

Post by tptacek »

lrvick wrote: post #110
tptacek wrote: post #102

Earlier quoted context omitted.

There are many ways to use PGP just as there are many ways to use openssl or any other cryptographic suite of tools. This is a very bad thing, because it is not in fact the case that there is one cryptosystem equally suited to all these tasks. That you chose OpenSSL as your corroborating example is especially funny, because there is exactly one thing that OpenSSL is actually well-suited to doing (setting up TLS sessi…

You spend a lot of energy steering people away from PGP, but what is your alternative to solve the same problems with the same threat models? What do you want to shift the entire software supply chain security foundation of the internet to use instead and how? Complaining the existing solution is not good enough is easy. Making things better and educating on current best efforts without creating centralized points of…

Did you not read the post I linked upthread? You were quite confident in refuting its claims, so I assume we shared an understanding here.

Update

It looks like you drastically edited your comment after I replied to it, in ways that change the meaning of your prompt. That makes it impossible for us to continue discussing anything.

Re: Switching from GPG to Age

#113

Post by lrvick »

akerl_ wrote: post #66
rmunn wrote: post #45

Earlier quoted context omitted.

As for how it improves security, I'm going to hazard a guess that many of the people sending zikduruqe those messages hadn't previously set up a PGP key. So by asking for the public key and refusing to send them the credentials until he receives it, he's forcing them to set one up, which then makes it possible for them to do things like sign messages. Just making someone set up a keypair doesn't mean they'll use it c…

It’s so easy to use insecurely that I will argue that employees setting up PGP keys and then potentially trying to use them does weaken the company’s security posture.

I agree it is easy for people to shoot themselves in the foot with many historcal PGP tools, which is exactly why we made keyfork.

It generates modern ECC PGP keychains with best practices in one shot, with multiple reasonably secure user friendly paper or smartcard, backup solutions.

You will really know what you are doing to force keyfork to generate an unsafe keychain. Especially if you use it on AirgapOS, which ships with it.

Re: Switching from GPG to Age

#114

Post by johnisgood »

tptacek wrote: post #98
johnisgood wrote: post #96

Earlier quoted context omitted.

I believe lrvick said that the spec isn't perfect but works fine in practice, and advises against old broken implementations of it. We will see. In any case, imperfection does not imply fundamental flaw. I might have missed it. Have you elaborated on why you think OpenPGP is fundamentally flawed? Do you know of any GPG replacements (or rather, OpenPGP replacements)? I want encryption, signing, key management, email i…

"Works fine in practice" is not responsive to "outmoded fundamentally, not just by one implementation". That commenter is substituting their own rooting interest in a particular outcome with a straightforward descriptive claim about the standard.

I would appreciate it if you answered to the rest of my comment. It may be quite useful.

Re: Switching from GPG to Age

#115

Post by lrvick »

tptacek wrote: post #106
lrvick wrote: post #105

Earlier quoted context omitted.

> Neither Google nor Apple rely on PGP for vulnerability disclosure handling. They support and rely on it exclusively for security disclosures sensitive enough to merit encryption.

"Sensitive enough" is smuggling in a presumption of yours that isn't supported by evidence. Whether or not submissions are PGP-encrypted (in my experience: they very rarely are) is uncorrelated with their severity.

In my experience building bug bounty programs for many high risk orgs, PGP reports are rare, as you indicate. Maybe a couple a year.

That does not make them any less critical or relied on. We always took them super seriously and read them offline because they were often highly sensitive real disclosures that merited being exposed only to a very small circle of people with security team decryption smartcards.

It is a safe assumption skiddies do not know how to use PGP so low skill reports with PGP almost never happened.

I would never run a bug bounty program without having an highly visible public key to encrypt highly sensitive reports to.

Re: Switching from GPG to Age

#116

Post by tptacek »

johnisgood wrote: post #114
tptacek wrote: post #98

Earlier quoted context omitted.

"Works fine in practice" is not responsive to "outmoded fundamentally, not just by one implementation". That commenter is substituting their own rooting interest in a particular outcome with a straightforward descriptive claim about the standard.

I would appreciate it if you answered to the rest of my comment. It may be quite useful.

I will not, because I joined this subthread to make a specific point (that the other commenter was simply wrong that the archaisms in PGP/OpenPGP are a mere consequence of GnuPG and avoidable by avoiding GnuPG), and this whole subthread has been an exercise in avoiding that point and switching to other more tractable arguments. I'm sorry, but I'm not interested.

Re: Switching from GPG to Age

#117

Post by tptacek »

lrvick wrote: post #115
tptacek wrote: post #106

Earlier quoted context omitted.

"Sensitive enough" is smuggling in a presumption of yours that isn't supported by evidence. Whether or not submissions are PGP-encrypted (in my experience: they very rarely are) is uncorrelated with their severity.

In my experience building bug bounty programs for many high risk orgs, PGP reports are rare, as you indicate. Maybe a couple a year. That does not make them any less critical or relied on. We always took them super seriously and read them offline because they were often highly sensitive real disclosures that merited being exposed only to a very small circle of people with security team decryption smartcards. It is a…

You haven't responded to my point. I would happily run a bounty program without a PGP key; in fact, I'd recommend not publishing a PGP key, and instead making arrangements to communicate a Signal identity.

Re: Switching from GPG to Age

#118

Post by knorker »

aborsy wrote: post #100
knorker wrote: post #53

Earlier quoted context omitted.

Yeah 128bit for symmetric is not enough, but it uses public key cryptography, right? "RECIPIENT can be an age public key generated by age-keygen ("age1...") or an SSH public key ("ssh-ed25519 AAAA...", "ssh-rsa AAAA...")."

It has both public key and symmetric mode. Even with public key, the file is encrypted in symmetric mode with a random key. The key is encrypted with pubkey. The file format is built around asymmetric cryptography, so maybe going to 256 bits required some work that the authors does not want. Not sure. Would have made sense to have standard ChaCha 20.

> The key is encrypted with pubkey.

Of course. That's how all public key crypto works. It's entirely infeasible to encrypt large payloads with a public keypair directly.

But this means that the symmetric key is entirely vulnerable to quantum computers. All you have to do is decrypt it.

> so maybe going to 256 bits

No, that's symmetric crypto key lengths, which are not the vulnerability when public keys involved are not PQ.

Re: Switching from GPG to Age

#119

Post by rmunn »

akerl_ wrote: post #67
rmunn wrote: post #43

Earlier quoted context omitted.

It allows the security guy (in this case, zikduruqe) to send an email that can only be read by the person who possesses the corresponding private key. Which means that either the email is going to the executive who really does own the account, or else that the attacker has already breached that executive's laptop to the point of having acquired his private key (and passphrase, if there was one), in which case phishin…

So I email you asking for something. You say “send me your public key first”. I generate a key pair and send the public key to you. You encrypt response giving me what I wanted. How do you have any idea that I’m the person I said I am?

Well, I've been assuming that zikduruqe is competent and knows how to pick up a phone and call the person (looking up a phone number in the company database) to verify that the public key came from him via fingerprint-checking over the phone. Sometimes people leave steps out so as not to write essays in a comment box.

Re: Switching from GPG to Age

#120

Post by akerl_ »

rmunn wrote: post #119
akerl_ wrote: post #67

Earlier quoted context omitted.

So I email you asking for something. You say “send me your public key first”. I generate a key pair and send the public key to you. You encrypt response giving me what I wanted. How do you have any idea that I’m the person I said I am?

Well, I've been assuming that zikduruqe is competent and knows how to pick up a phone and call the person (looking up a phone number in the company database) to verify that the public key came from him via fingerprint-checking over the phone. Sometimes people leave steps out so as not to write essays in a comment box.

My confusion here is that if you're doing that, why bother with the cryptography? You can just look the person up in the company database, call them, and say "Hey! Did you just request a password reset?".

If one of your pre-requisites is "There is a trusted out-of-band way for me to validate comms with this person", the crypto is just extra bits.

Post reply on HN