OpenPGPjs v3.0
protonmail.com
OpenPGPjs v3.0
1–10 of 46 posts
Re: OpenPGPjs v3.0
#2In case anyone that doesn't follow the development of the library closely missed it, the main improvement in this version is the introduction of ECC support. ECC tends to be able to provide equivalent levels of security as traditional "big prime" cryptography (like RSA) with less computationally intensive operations. This is especially important in a library like OpenPGPjs that is primarily meant for in browser based web usage because it should make things, like sending and receiving mail, faster when ECC is used over older PGP public key encryption systems. For people that use ProtonMail's web based crypto on mobile or tablet devices, a switch to ECC would result not just in similar performance improvements but also in lower battery usage.
Currently, ProtonMail uses RSA keys, but this addition of ECC support to their web encryption library may mean that they are about to start switching users to ECC keys. Because using "larger" (when compared with equivalent theoretical strength RSA keys, for example) ECC keys is less resource intensive than using higher security keys in some other forms of cryptosystems (like RSA) it may also be an indication that ProtonMail is preparing to upgrade users to higher security/stronger keys.
Many cryptographers and organizations, including the US Government, have recommended for a long time that people migrate from older "big prime cryptography" based cryptosystems to ECC based cryptosystems for increased security.
Re: OpenPGPjs v3.0
#3Great to see protonmail working on this.
It's shocking how much sensitive data is sent by mail (contracts, passwords, lawyers, etc..) without pgp signing / encryption on a daily basis.
Re: OpenPGPjs v3.0
#4I wish something like this would take off -
https://github.com/kylehuff/webpg-chrome
We deserve a better userspace from our browsers. The excuse that "users" don't want this because its "hard" is circular.
Re: OpenPGPjs v3.0
#5I don't get it. Protonmail still doesn't support PGP, yet they're working on open source libraries for other people to implement PGP? I don't understand these priorities.
Re: OpenPGPjs v3.0
#6I don't get it. Protonmail still doesn't support PGP, yet they're working on open source libraries for other people to implement PGP? I don't understand these priorities.
What do you mean "ProtonMail still doesn't support PGP"? You mean sending PGP encrypted e-mails to non-protonmail addresses?
Re: OpenPGPjs v3.0
#7In case anyone that doesn't follow the development of the library closely missed it, the main improvement in this version is the introduction of ECC support. ECC tends to be able to provide equivalent levels of security as traditional "big prime" cryptography (like RSA) with less computationally intensive operations. This is especially important in a library like OpenPGPjs that is primarily meant for in browser based…
> In case anyone that doesn't follow the development of the library closely missed it, the main improvement in this version is the introduction of ECC support.
Wow...I'm sort of shocked that wasn't a v1.0 consideration.
> ECC tends to be able to provide equivalent levels of security as traditional "big prime" cryptography (like RSA) with less computationally intensive operations. This is especially important in a library like OpenPGPjs that is primarily meant for in browser based web usage because it should make things, like sending and receiving mail, faster when ECC is used over older PGP public key encryption systems. For people that use ProtonMail's web based crypto on mobile or tablet devices, a switch to ECC would result not just in similar performance improvements but also in lower battery usage.
In particular, elliptic curves have smaller parameters, which allow for smaller keys at the same bit security level. For example, to achieve 128-bit security, an RSA/DLP modulus must be 3072 bits. Elliptic curves achieve the same security level with only 256-bit parameters. They are also faster for most operations, but RSA is still technically faster for signature verification.
> Many cryptographers and organizations, including the US Government, have recommended for a long time that people migrate from older "big prime cryptography" based cryptosystems to ECC based cryptosystems for increased security.
True, but elliptic curve cryptography is just as vulnerable to quantum computers, however long off that problem may be.
Re: OpenPGPjs v3.0
#8I don't get it. Protonmail still doesn't support PGP, yet they're working on open source libraries for other people to implement PGP? I don't understand these priorities.
The library is the prerequisite for proper PGP support in ProtonMail, so it obviously needs to be built first.
Re: OpenPGPjs v3.0
#9What is the threat model for PGP in JS? Like, is there an Alice, Bob, Carol, Eve story under which PGP in JS makes sense?
The canonical example that IMO doesn't make sense is when Alice and Bob want to communicate privately using Eve as an webmail provider who wants to snoop in on the communications. Alice and Bob can't just trust Eve to provide a copy of OpenPGPjs in a tag on EveMail.com, because then they're trusting Eve to provide a legitimate PGP implementation, trusting Eve not to log their keystrokes in JS, etc.
I can understand OpenPGPjs as a server-side library in Node (though I suspect it would be safer to run a battle-hardened library like GPG with node FFI).
But, in client-side web code, how could this ever make sense?
Re: OpenPGPjs v3.0
#10I don't get it. Protonmail still doesn't support PGP, yet they're working on open source libraries for other people to implement PGP? I don't understand these priorities.
The library is the prerequisite for proper PGP support in ProtonMail, so it obviously needs to be built first.
You mean the library that you've been using from the beginning of the proper web client? This is not an answer. Kudos for finally doing ECC though.