19 ms·

OpenPGP really works

143 points by ergot 10y ago

tptacek 10y ago
As a sort of basically reliable swiss army knife for file-based encryption problems, the kinds of problems you'd otherwise use AES passphrase-encrypted ZIP files to solve, PGP not only works but also has a bad rap. And there are a lot of those problems! Maybe even the majority of them! But PGP was designed for message encryption, and it's a poor choice for message encryption. The community is gradually converging on the idea that SMTP store-and-forward email is just never going to be cryptographically safe, and pretty much the only messaging application in which PGP makes any sense is SMTP email. What's worse is, much of the PGP ecosystem really only makes sense in a messaging context. Which means that the complex parts of PGP, like key servers and subkeys and things like that, aren't really adding value, but still confuse and distract users.
- lovich 10y ago
  A little off topic but could you point me towards some resources for learning about what pgp was meant to solve? I've read back and forth opinions about it on hackernews,reddit, etc but I've not seen a definitive description of how it attempts to solve the problem of encrypted communication that wasn't heavily editorialized.
  - cpach 10y ago
    These links might be interesting to you: http://www.pgpi.org/doc/ http://www.pgpi.org/doc/
  - WorldMaker 10y ago
    A lay nutshell summary: there is one giant problem in crypto systems since the dawn of time; how to distribute the keys to locked documents/files and keep those keys out of the "wrong hands". For the majority of history of cryptology, the only option was symmetric keys (the same key is used to lock the document as to unlock it). This is conceptually simple (she who has the key has the access), but at the cost of making distributing these keys a giant challenge of secrecy (anyone can intercept that key in transit and use it to unlock documents; worse, someone can intercept that key and the people who are supposed to use the key might not even be aware someone could be snooping). Asymmetric key algorithms, where the key used to unlock the document is different from the key used to lock it, were long considered the "holy grail" for cryptography. With an asymmetric key, I can closely guard the "unlock key" (private key), but shout out the "lock key" (public key) from the rooftops or post it on flyers and anyone could send me documents in secret that only I could unlock. (That unlocks the next, and still current, major problem in that how do you as someone looking to send a secret document to me trust that the person shouting that night from the rooftops or posting that flyer is actually me, much less know which flyers to look for or that I might shout it sometimes from rooftops...) PGP was the first software built "for the masses" that made asymmetric key crypto accessible to the "common computer users". (PGP is also notable for attempting to build one such potential trust system to find/trust keys, the Web of Trust model. This is where most of the contemporary arguments about the value of PGP these days are targeted. The Web of Trust is a useful solution, but its a complicated solution that doesn't scale as well as it should and has a bad user experience with a sharp learning curve and a long tail of key management complications for even power users.)
  - DanBC 10y ago
    > > As a sort of basically reliable swiss army knife for file-based encryption problems, the kinds of problems you'd otherwise use AES passphrase-encrypted ZIP files to solve, PGP not only works but also has a bad rap. I have a text file. I encrypt it using a key. I send you the encrypted text file. How do you decrypt it? You need the key. If I can send you the key securely why don't I just send the plain message using that secure mechanism? Public key cryptography solves that problem.
    - tedunangst 10y ago
      Who said anything about sending the file anywhere?
  - j_s 10y ago
    Secure communication with PGP is a pain. https://gist.github.com/grugq/03167bed45e774551155 https://gist.github.com/grugq/03167bed45e774551155
    - tptacek 10y ago
      Yes, this. But remember: a lot of this is about electronic mail, not PGP in particular.
- tedunangst 10y ago
  If you just want to encrypt a file, scrypt works well for this purpose.
  - twr 10y ago
    I didn't know Colin also wrote an encryption utility that uses the scrypt KDF. It does seem better than using GPG to password encrypt files.
- noinsight 10y ago
  > AES passphrase-encrypted ZIP files 7-Zip is pretty awesome for actually usable encryption. On Windows, with the Explorer integration, you can just right click a file, select "Add to archive" and create an AES-256 encrypted 7-Zip archive that anyone with 7-Zip can extract just by entering the password.
- s-phi-nl 10y ago
  Could you give an example of "problems you'd otherwise use AES passphrase-encrypted ZIP files to solve"? Do any of them involve sending the data anywhere (i.e., the sender and receiver are the same person)?
  - s-phi-nl 10y ago
    I think my question is now answered by https://news.ycombinator.com/item?id=13383171 https://news.ycombinator.com/item?id=13383171, in particular https://news.ycombinator.com/item?id=13383211 https://news.ycombinator.com/item?id=13383211.
  - deleted 10y ago
    [deleted]
SFJulie 10y ago
No one criticizes openPGP on the crypto point of view. It is the UX/UI experience that anger people to the highest point. Noobs like long time users. Correct key handling (signing, revoking, publishing and sometimes doing actually the job) is a burden. Nothing is wrong with the code so far. Much more whatever correct the software is, it is a pain. My guess, is that true correct cryptography requires this burden whatever the algorithms are because ensuring identity are trustable is where the more work is, and no software can do it.
- dom0 10y ago
  > No one criticizes openPGP on the crypto point of view. Hm? Of course PGP is criticized for that, just less vocally. - Authentication is off by default in GPG - Even so, it's very complex, and most of the protocol isn't authenticated [ This is problematic, because ciphers tend to be more or less easily malleable, so non-signed messages can be tampered with; this is also an issue for encrypting files symmetrically ] (- Compression is on by default and makes everything super-slow for no good reason) - Widely used defaults for encryption and key derivation are rather arcane (eg. CAST5) - PGP signatures, by principle, are non-repudiatiable, unlike most modern encrypted chat applications, so they prove to _anyone_ _forever_ that your key signed that message. - PGP format announces all recipients to the world - No forward secrecy possible - ...
  - criddell 10y ago
    Would the lack of perfect forward secrecy be considered a shortcoming?
- dispose13432 10y ago
  Web of Trust seems to be an inherently broken paradigm. Think about this. Let's say I trust my friends (so when my friends sign John Doe is John Doe, it's really him). It's a big deal (not every friend is so security conscious, maybe he met this guy on facebook and looks so real), but would I trust someone because of a friends-friend's recommendation? I know which friends are naive. But which friend's-friend's-friend is naive? And those are the only web-of-trust connection I have with him? Can I trust him? Can I not? How do I tell?
sleepless 10y ago
I have been using OpenPGP for years without problems. Key transition / exchange / verification can be a bit painful, but actually it is not that hard. Also the longer you use OpenPGP, the less keys need to be verified. The start is very hard, since you start with no trusted keys at all. The longer you use it, the more fluent usage becomes. Have been using GPG Suite on macOS and the only problem is, you may not get support for the new macOS on day 1 since apple provides no API for Mail.app. And then again, giving Apple some time to figure out their bugs of the intial major release isn't a bad idea.
- FiloSottile 10y ago
  > Also the longer you use OpenPGP, the less keys need to be verified. The start is very hard, since you start with no trusted keys at all. The longer you use it, the more fluent usage becomes. This is exactly what scares me and the point of my "I'm giving up on PGP" article. People holding on to keys forever, moving them from laptop to laptop, never rotating them and asymptotically approaching compromise... because it's the only way to ease the pain.
  - peatmoss 10y ago
    How do you feel about Yubikey-based keys? Asking for a friend...
    - subway 10y ago
      Most workflows utilizing OpenPGP cards (like the Yubikey) encourage better key hygiene. Generally you'd create a certification key which lives offline 100% of the time, with a subkey issued to the Yubikey. This means your offline key can persist for a very long time while you can safely rotate the day to day subkey. Unfortunately while these workflows are encouraged, the tooling doesn't exist to make it a trivial operation for folks not familiar with proper key hygiene.
    - matheusmoreira 10y ago
      I have a YubiKey myself and they're really convenient. There's a cryptoprocessor inside so the key doesn't have to leave the device. I think it's more secure than a regular computer connected to the internet. After reading¹² about this subject, I believe a reasonable level of security and ease-of-use can be achieved through the following process: 1. Boot a live Linux distribution such as Tails on a computer disconnected from the Internet. 2. Create the OpenPGP master key. 3. Initialize the YubiKey with subkeys. 4. Store the master key offline using paperkey³ and a machine-readable code. The YubiKey is secure and convenient enough for daily use; the subkeys can be easily revoked and the hardware reinitialized with new keys. Master key operations such as key signing and changing expiration dates require loading the master key into the offline live operating system. Much more of a hassle but hopefully not as frequent as YubiKey use. Printing the master key on quality paper ensures³ it will survive for a long time. ¹ http://security.stackexchange.com/a/51776/9252 http://security.stackexchange.com/a/51776/9252 ² http://security.stackexchange.com/a/31598/9252 http://security.stackexchange.com/a/31598/9252 ³ http://www.jabberwocky.com/software/paperkey/ http://www.jabberwocky.com/software/paperkey/
chakalakasp 10y ago
The ultimate engineer's perspective. It works so well that almost nobody uses it! Signal isn't even that popular compared to other platforms like iMessage, but I bet more people use it than regularly PGP. I was regularly signing messages with PGP on Fidonet all the way back in '93 (and trying to find people to swap encrypted messages with). It's a bit mind blowing that the useability of the successor program today, GPG, isn't much better than what people thought was kinda wonkish and hard back in the Compuserve days.
- hollander 10y ago
  I sign almost all outgoing mail, hoping someone will notice. In three years I've got one question about it. Some people complain they can't open the attachment, as I use PGP/MIME to keep the message readable. If big companies like Apple and Google were behind this, it could change, but I'm afraid this won't happen unless there is a sudden need for it.
  - wanderingbort 10y ago
    > If big companies like Apple and Google were behind this, it could change, but I'm afraid this won't happen unless there is a sudden need for it. Digital privacy for average consumers needs more than a brand behind it, it needs an obvious value. I don't think many average people actually suspect that email _can_ be tampered with so, what does "signing" it mean to them. Moreover, when/if it enters the mainstream it will be plagued with "hacks" which degrade the user-perceived value, causing many to abandon it if it isn't free. by "hacks" I mean the users will expose keys and then blame AES :)
  - nihonde 10y ago
    If ever there were a user group that should have forced pgp adoption, it is lawyers. When I worked at a big law firm, I lobbied for it and ran into a bunch of IT managers who had never heard of anything unless Microsoft sold it to them.
  - nhxu 10y ago
    > If big companies like Apple and Google were behind this, it could change, but I'm afraid this won't happen unless there is a sudden need for it. End-to-end [1] is using OpenPGP. [1]: https://github.com/google/end-to-end/ https://github.com/google/end-to-end/
tibu 10y ago
My mobile Chrome is complaining about the site's certificate. Does this happen for others too? It seems it is having an issue with the issuer which is Let's Encrypt. Really strange.
alexnewman 10y ago
online and offline are both important. Is pgp implemented on any formally verified code base?
- nickpsecurity 10y ago
  No. I've only seen two, formal verifications of secure email with neither being PGP. I can't find the link to one but the other of Privacy-Enhanced Mail is here: https://pdfs.semanticscholar.org/b6e2/3ac057b8716ebd4ab7831f4c4e03bdad59d4.pdf https://pdfs.semanticscholar.org/b6e2/3ac057b8716ebd4ab7831f... They use Kesterel's Specware tools to essentially turn it from HOL properties to a formal design with code generation following. Kesterel was kind enough to open-source some of their stuff: https://github.com/KestrelInstitute/Specware/ https://github.com/KestrelInstitute/Specware/ However, recent results in other tooling suggest the best way to go about it would be using tools like F* in miTLS, CRYPTOL, SPARK Ada, and/or Frama-C. Each component of a basic, subset of PGP has already been verified in isolation. Now, the algorithms just need to be fed into such tools, the protocol speced out miTLS-style, the integration proven sound, and object code shown to match the source. It looks doable with today's formal methods. More a matter of available labor and interest.
Khaine 10y ago
It doesn't

143 points by ergot 10y ago

As a sort of basically reliable swiss army knife for file-based encryption problems, the kinds of problems you'd otherwise use AES passphrase-encrypted ZIP files to solve, PGP not only works but also has a bad rap. And there are a lot of those problems! Maybe even the majority of them! But PGP was designed for message encryption, and it's a poor choice for message encryption. The community is gradually converging on the idea that SMTP store-and-forward email is just never going to be cryptographically safe, and pretty much the only messaging application in which PGP makes any sense is SMTP email. What's worse is, much of the PGP ecosystem really only makes sense in a messaging context. Which means that the complex parts of PGP, like key servers and subkeys and things like that, aren't really adding value, but still confuse and distract users.

lovich 10y ago
A little off topic but could you point me towards some resources for learning about what pgp was meant to solve? I've read back and forth opinions about it on hackernews,reddit, etc but I've not seen a definitive description of how it attempts to solve the problem of encrypted communication that wasn't heavily editorialized.
- cpach 10y ago
  These links might be interesting to you: http://www.pgpi.org/doc/ http://www.pgpi.org/doc/
- WorldMaker 10y ago
  A lay nutshell summary: there is one giant problem in crypto systems since the dawn of time; how to distribute the keys to locked documents/files and keep those keys out of the "wrong hands". For the majority of history of cryptology, the only option was symmetric keys (the same key is used to lock the document as to unlock it). This is conceptually simple (she who has the key has the access), but at the cost of making distributing these keys a giant challenge of secrecy (anyone can intercept that key in transit and use it to unlock documents; worse, someone can intercept that key and the people who are supposed to use the key might not even be aware someone could be snooping). Asymmetric key algorithms, where the key used to unlock the document is different from the key used to lock it, were long considered the "holy grail" for cryptography. With an asymmetric key, I can closely guard the "unlock key" (private key), but shout out the "lock key" (public key) from the rooftops or post it on flyers and anyone could send me documents in secret that only I could unlock. (That unlocks the next, and still current, major problem in that how do you as someone looking to send a secret document to me trust that the person shouting that night from the rooftops or posting that flyer is actually me, much less know which flyers to look for or that I might shout it sometimes from rooftops...) PGP was the first software built "for the masses" that made asymmetric key crypto accessible to the "common computer users". (PGP is also notable for attempting to build one such potential trust system to find/trust keys, the Web of Trust model. This is where most of the contemporary arguments about the value of PGP these days are targeted. The Web of Trust is a useful solution, but its a complicated solution that doesn't scale as well as it should and has a bad user experience with a sharp learning curve and a long tail of key management complications for even power users.)
- DanBC 10y ago
  > > As a sort of basically reliable swiss army knife for file-based encryption problems, the kinds of problems you'd otherwise use AES passphrase-encrypted ZIP files to solve, PGP not only works but also has a bad rap. I have a text file. I encrypt it using a key. I send you the encrypted text file. How do you decrypt it? You need the key. If I can send you the key securely why don't I just send the plain message using that secure mechanism? Public key cryptography solves that problem.
  - tedunangst 10y ago
    Who said anything about sending the file anywhere?
- j_s 10y ago
  Secure communication with PGP is a pain. https://gist.github.com/grugq/03167bed45e774551155 https://gist.github.com/grugq/03167bed45e774551155
  - tptacek 10y ago
    Yes, this. But remember: a lot of this is about electronic mail, not PGP in particular.
tedunangst 10y ago
If you just want to encrypt a file, scrypt works well for this purpose.
- twr 10y ago
  I didn't know Colin also wrote an encryption utility that uses the scrypt KDF. It does seem better than using GPG to password encrypt files.
noinsight 10y ago
> AES passphrase-encrypted ZIP files 7-Zip is pretty awesome for actually usable encryption. On Windows, with the Explorer integration, you can just right click a file, select "Add to archive" and create an AES-256 encrypted 7-Zip archive that anyone with 7-Zip can extract just by entering the password.
s-phi-nl 10y ago
Could you give an example of "problems you'd otherwise use AES passphrase-encrypted ZIP files to solve"? Do any of them involve sending the data anywhere (i.e., the sender and receiver are the same person)?
- s-phi-nl 10y ago
  I think my question is now answered by https://news.ycombinator.com/item?id=13383171 https://news.ycombinator.com/item?id=13383171, in particular https://news.ycombinator.com/item?id=13383211 https://news.ycombinator.com/item?id=13383211.
- deleted 10y ago
  [deleted]

SFJulie 10y ago

No one criticizes openPGP on the crypto point of view. It is the UX/UI experience that anger people to the highest point. Noobs like long time users. Correct key handling (signing, revoking, publishing and sometimes doing actually the job) is a burden. Nothing is wrong with the code so far. Much more whatever correct the software is, it is a pain. My guess, is that true correct cryptography requires this burden whatever the algorithms are because ensuring identity are trustable is where the more work is, and no software can do it.

dom0 10y ago
> No one criticizes openPGP on the crypto point of view. Hm? Of course PGP is criticized for that, just less vocally. - Authentication is off by default in GPG - Even so, it's very complex, and most of the protocol isn't authenticated [ This is problematic, because ciphers tend to be more or less easily malleable, so non-signed messages can be tampered with; this is also an issue for encrypting files symmetrically ] (- Compression is on by default and makes everything super-slow for no good reason) - Widely used defaults for encryption and key derivation are rather arcane (eg. CAST5) - PGP signatures, by principle, are non-repudiatiable, unlike most modern encrypted chat applications, so they prove to _anyone_ _forever_ that your key signed that message. - PGP format announces all recipients to the world - No forward secrecy possible - ...
- criddell 10y ago
  Would the lack of perfect forward secrecy be considered a shortcoming?
dispose13432 10y ago
Web of Trust seems to be an inherently broken paradigm. Think about this. Let's say I trust my friends (so when my friends sign John Doe is John Doe, it's really him). It's a big deal (not every friend is so security conscious, maybe he met this guy on facebook and looks so real), but would I trust someone because of a friends-friend's recommendation? I know which friends are naive. But which friend's-friend's-friend is naive? And those are the only web-of-trust connection I have with him? Can I trust him? Can I not? How do I tell?

sleepless 10y ago

I have been using OpenPGP for years without problems. Key transition / exchange / verification can be a bit painful, but actually it is not that hard. Also the longer you use OpenPGP, the less keys need to be verified. The start is very hard, since you start with no trusted keys at all. The longer you use it, the more fluent usage becomes. Have been using GPG Suite on macOS and the only problem is, you may not get support for the new macOS on day 1 since apple provides no API for Mail.app. And then again, giving Apple some time to figure out their bugs of the intial major release isn't a bad idea.

FiloSottile 10y ago
> Also the longer you use OpenPGP, the less keys need to be verified. The start is very hard, since you start with no trusted keys at all. The longer you use it, the more fluent usage becomes. This is exactly what scares me and the point of my "I'm giving up on PGP" article. People holding on to keys forever, moving them from laptop to laptop, never rotating them and asymptotically approaching compromise... because it's the only way to ease the pain.
- peatmoss 10y ago
  How do you feel about Yubikey-based keys? Asking for a friend...
  - subway 10y ago
    Most workflows utilizing OpenPGP cards (like the Yubikey) encourage better key hygiene. Generally you'd create a certification key which lives offline 100% of the time, with a subkey issued to the Yubikey. This means your offline key can persist for a very long time while you can safely rotate the day to day subkey. Unfortunately while these workflows are encouraged, the tooling doesn't exist to make it a trivial operation for folks not familiar with proper key hygiene.
  - matheusmoreira 10y ago
    I have a YubiKey myself and they're really convenient. There's a cryptoprocessor inside so the key doesn't have to leave the device. I think it's more secure than a regular computer connected to the internet. After reading¹² about this subject, I believe a reasonable level of security and ease-of-use can be achieved through the following process: 1. Boot a live Linux distribution such as Tails on a computer disconnected from the Internet. 2. Create the OpenPGP master key. 3. Initialize the YubiKey with subkeys. 4. Store the master key offline using paperkey³ and a machine-readable code. The YubiKey is secure and convenient enough for daily use; the subkeys can be easily revoked and the hardware reinitialized with new keys. Master key operations such as key signing and changing expiration dates require loading the master key into the offline live operating system. Much more of a hassle but hopefully not as frequent as YubiKey use. Printing the master key on quality paper ensures³ it will survive for a long time. ¹ http://security.stackexchange.com/a/51776/9252 http://security.stackexchange.com/a/51776/9252 ² http://security.stackexchange.com/a/31598/9252 http://security.stackexchange.com/a/31598/9252 ³ http://www.jabberwocky.com/software/paperkey/ http://www.jabberwocky.com/software/paperkey/

chakalakasp 10y ago

The ultimate engineer's perspective. It works so well that almost nobody uses it! Signal isn't even that popular compared to other platforms like iMessage, but I bet more people use it than regularly PGP. I was regularly signing messages with PGP on Fidonet all the way back in '93 (and trying to find people to swap encrypted messages with). It's a bit mind blowing that the useability of the successor program today, GPG, isn't much better than what people thought was kinda wonkish and hard back in the Compuserve days.

hollander 10y ago
I sign almost all outgoing mail, hoping someone will notice. In three years I've got one question about it. Some people complain they can't open the attachment, as I use PGP/MIME to keep the message readable. If big companies like Apple and Google were behind this, it could change, but I'm afraid this won't happen unless there is a sudden need for it.
- wanderingbort 10y ago
  > If big companies like Apple and Google were behind this, it could change, but I'm afraid this won't happen unless there is a sudden need for it. Digital privacy for average consumers needs more than a brand behind it, it needs an obvious value. I don't think many average people actually suspect that email _can_ be tampered with so, what does "signing" it mean to them. Moreover, when/if it enters the mainstream it will be plagued with "hacks" which degrade the user-perceived value, causing many to abandon it if it isn't free. by "hacks" I mean the users will expose keys and then blame AES :)
- nihonde 10y ago
  If ever there were a user group that should have forced pgp adoption, it is lawyers. When I worked at a big law firm, I lobbied for it and ran into a bunch of IT managers who had never heard of anything unless Microsoft sold it to them.
- nhxu 10y ago
  > If big companies like Apple and Google were behind this, it could change, but I'm afraid this won't happen unless there is a sudden need for it. End-to-end [1] is using OpenPGP. [1]: https://github.com/google/end-to-end/ https://github.com/google/end-to-end/

tibu 10y ago

My mobile Chrome is complaining about the site's certificate. Does this happen for others too? It seems it is having an issue with the issuer which is Let's Encrypt. Really strange.

alexnewman 10y ago

online and offline are both important. Is pgp implemented on any formally verified code base?

nickpsecurity 10y ago
No. I've only seen two, formal verifications of secure email with neither being PGP. I can't find the link to one but the other of Privacy-Enhanced Mail is here: https://pdfs.semanticscholar.org/b6e2/3ac057b8716ebd4ab7831f4c4e03bdad59d4.pdf https://pdfs.semanticscholar.org/b6e2/3ac057b8716ebd4ab7831f... They use Kesterel's Specware tools to essentially turn it from HOL properties to a formal design with code generation following. Kesterel was kind enough to open-source some of their stuff: https://github.com/KestrelInstitute/Specware/ https://github.com/KestrelInstitute/Specware/ However, recent results in other tooling suggest the best way to go about it would be using tools like F* in miTLS, CRYPTOL, SPARK Ada, and/or Frama-C. Each component of a basic, subset of PGP has already been verified in isolation. Now, the algorithms just need to be fed into such tools, the protocol speced out miTLS-style, the integration proven sound, and object code shown to match the source. It looks doable with today's formal methods. More a matter of available labor and interest.

Khaine 10y ago

It doesn't