Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PGP Marks 30th Anniversary

philzimmermann.com

Post reply on HN
Print view View original

51–60 of 82 posts

Re: PGP Marks 30th Anniversary

#51

Post by GekkePrutser »

schoen wrote: post #6
waynesonfire wrote: post #3

such a great tool. It's not a serious security product unless you support PGP.

I'm a huge fan of Phil and his work, and plan to send him a note of thanks, but I think your second sentiment is out-of-date now. Even if we avoid other controversies like Thomas Ptacek's views about the inappropriateness of the e-mail encryption threat model, PGP doesn't support forward secrecy and so it's at least not suitable for instant messaging or TLS (as well as not being integrated into their protocols!). A s…

Perfect Forward Secrecy isn't possible with PGP, as with Email as the underlying mechanism there is no direct communication between peers. Email is more of a "fire and forget" mechanism. You can publish your PGP key and get an email from someone you never communicated with before. That can't be done with PFS.

Re: PGP Marks 30th Anniversary

#52

Post by dane-pgp »

mratsim wrote: post #45

Please let PGP retire as a pioneer now and not as a laggard tomorrow. - https://latacora.micro.blog/2019/07/16/the-pgp-problem.html - https://soatok.blog/2020/07/08/gnu-a-heuristic-for-bad-crypt... - https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d695...

If we're sharing obligatory links, then a detailed critique of "The PGP Problem" is:

https://articles.59.ca/doku.php?id=pgpfan:tpp

It's true, though, that much work is needed to bring PGP up to the levels expected of modern crypto tools. Hopefully some of that will happen as a result of the work happening in the IETF:

https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-re...

and due to technology built around it, such as:

https://delta.chat/en/

https://autocrypt.org/

Re: PGP Marks 30th Anniversary

#53

Post by upofadown »

tptacek wrote: post #49
upofadown wrote: post #32

Earlier quoted context omitted.

Last I looked "age" did not have any sort of recovery utility. It isn't even clear that such a utility is possible (the protocol is poorly documented). A single bit error at the start of the file causes the loss of the entire file. So be careful using it for any sort of thing that might ever require the sort of recovery that bzip2 or lzip provides (gzip has a third party recovery utility). OpenPGP has excellent recov…

I want to be sure I'm reading this correctly. Failing to decrypt on a single bit error is the literal job definition of authenticated encryption. Any error you accept is malleability conceded to an attacker. Are you complaining that age isn't malleable enough ?

>Failing to decrypt on a single bit error is the literal job definition of authenticated encryption.

Yes, this is an excellent example of where this behaviour is suboptimal. We should not cargo cult authenticated encryption. It has its place but this isn't it.

> Any error you accept is malleability conceded to an attacker.

Sure, but malleability that has a close to zero chance of being a problem. We are talking about static encryption here. You only get one chance at malleability and the user immediately knows something has gone wrong:

    gpg: WARNING: encrypted message has been manipulated!
>Are you complaining that age isn't malleable enough?

Merely pointing out that for the most common use case age is objectively worse than GPG.

Re: PGP Marks 30th Anniversary

#54

Post by atoponce »

upofadown wrote: post #32
greenyoda wrote: post #9

Earlier quoted context omitted.

Thanks! Link to "age", for those who are interested: https://github.com/FiloSottile/age

Last I looked "age" did not have any sort of recovery utility. It isn't even clear that such a utility is possible (the protocol is poorly documented). A single bit error at the start of the file causes the loss of the entire file. So be careful using it for any sort of thing that might ever require the sort of recovery that bzip2 or lzip provides (gzip has a third party recovery utility). OpenPGP has excellent recov…

What exactly is an OpenPGP recovery property? Can you point it out in the RFC?

Re: PGP Marks 30th Anniversary

#55

Post by tptacek »

upofadown wrote: post #53
tptacek wrote: post #49

Earlier quoted context omitted.

I want to be sure I'm reading this correctly. Failing to decrypt on a single bit error is the literal job definition of authenticated encryption. Any error you accept is malleability conceded to an attacker. Are you complaining that age isn't malleable enough ?

>Failing to decrypt on a single bit error is the literal job definition of authenticated encryption. Yes, this is an excellent example of where this behaviour is suboptimal. We should not cargo cult authenticated encryption. It has its place but this isn't it. > Any error you accept is malleability conceded to an attacker. Sure, but malleability that has a close to zero chance of being a problem. We are talking about…

I think you are doing a fine job of advocating the position that PGP is the cryptosystem of choice for people who believe authenticated encryption is a cargo cult.

The logic you're applying here about how GPG can warn you if it has employed "recovery properties" to correct "single bit errors" was embraced enthusiastically by the Ruhr team to perform data recovery on other people's PGP-encrypted email messages.

Re: PGP Marks 30th Anniversary

#56

Post by upofadown »

atoponce wrote: post #54
upofadown wrote: post #32

Earlier quoted context omitted.

Last I looked "age" did not have any sort of recovery utility. It isn't even clear that such a utility is possible (the protocol is poorly documented). A single bit error at the start of the file causes the loss of the entire file. So be careful using it for any sort of thing that might ever require the sort of recovery that bzip2 or lzip provides (gzip has a third party recovery utility). OpenPGP has excellent recov…

What exactly is an OpenPGP recovery property? Can you point it out in the RFC?

OpenPGP specifies cipher feed back (CFB) mode[1] for block ciphers (normally AES). CFB has the inherent property that it is self healing in the face of corruption. It does not work in all possible instances of corruption but it works for the normal sort of corruption that is seen with mass storage devices (multiples of 512 bytes). A practical example here[2].

[1] https://datatracker.ietf.org/doc/html/rfc4880#section-13.9

[2] https://articles.59.ca/doku.php?id=pgpfan:agevspgp#encrypted...

Re: PGP Marks 30th Anniversary

#57

Post by JshWright »

dane-pgp wrote: post #48
JshWright wrote: post #40

Earlier quoted context omitted.

> I'm not sure if it was Phill or not One "l" (it's the "z" at the end of "Zimmermann" that's doubled).

> it's the "z" at the end of "Zimmermann" that's doubled Actually it's the "n" at the beginning of "Zimmermann" that is doubled.

Oh man... I got to work w/ prz for several years (which is why the "two n's" thing stands out in my memory, since it's a common typo). And yet somehow, I still managed to screw that up...

Re: PGP Marks 30th Anniversary

#58

Post by some_furry »

upofadown wrote: post #53
tptacek wrote: post #49

Earlier quoted context omitted.

I want to be sure I'm reading this correctly. Failing to decrypt on a single bit error is the literal job definition of authenticated encryption. Any error you accept is malleability conceded to an attacker. Are you complaining that age isn't malleable enough ?

>Failing to decrypt on a single bit error is the literal job definition of authenticated encryption. Yes, this is an excellent example of where this behaviour is suboptimal. We should not cargo cult authenticated encryption. It has its place but this isn't it. > Any error you accept is malleability conceded to an attacker. Sure, but malleability that has a close to zero chance of being a problem. We are talking about…

> Sure, but malleability that has a close to zero chance of being a problem.

https://efail.de

https://tonyarcieri.com/all-the-crypto-code-youve-ever-writt...

This isn't even a controversy among cryptographers or cryptography engineers.

Re: PGP Marks 30th Anniversary

#59

Post by GekkePrutser »

dane-pgp wrote: post #48
JshWright wrote: post #40

Earlier quoted context omitted.

> I'm not sure if it was Phill or not One "l" (it's the "z" at the end of "Zimmermann" that's doubled).

> it's the "z" at the end of "Zimmermann" that's doubled Actually it's the "n" at the beginning of "Zimmermann" that is doubled.

Actually, the "m" in the middle of "Zimmermann" is also doubled! :)

Re: PGP Marks 30th Anniversary

#60

Post by btilly »

tptacek wrote: post #49
upofadown wrote: post #32

Earlier quoted context omitted.

Last I looked "age" did not have any sort of recovery utility. It isn't even clear that such a utility is possible (the protocol is poorly documented). A single bit error at the start of the file causes the loss of the entire file. So be careful using it for any sort of thing that might ever require the sort of recovery that bzip2 or lzip provides (gzip has a third party recovery utility). OpenPGP has excellent recov…

I want to be sure I'm reading this correctly. Failing to decrypt on a single bit error is the literal job definition of authenticated encryption. Any error you accept is malleability conceded to an attacker. Are you complaining that age isn't malleable enough ?

This makes no sense to me.

If I run a file through age, and then run that through a Reed-Solomon encoder, I now have a file that can be decoded even with single bit errors. But I think I also still have authenticated encryption. The cost is that my file takes a bit of extra space.

Am I missing something?

Post reply on HN