3 ms·

No one criticizes openPGP on the crypto point of view. It is the UX/UI experience that anger people to the highest point. Noobs like long time users. Correct

by SFJulie 10y ago

No one criticizes openPGP on the crypto point of view. It is the UX/UI experience that anger people to the highest point. Noobs like long time users. Correct key handling (signing, revoking, publishing and sometimes doing actually the job) is a burden. Nothing is wrong with the code so far. Much more whatever correct the software is, it is a pain. My guess, is that true correct cryptography requires this burden whatever the algorithms are because ensuring identity are trustable is where the more work is, and no software can do it.

dom0 10y ago
> No one criticizes openPGP on the crypto point of view. Hm? Of course PGP is criticized for that, just less vocally. - Authentication is off by default in GPG - Even so, it's very complex, and most of the protocol isn't authenticated [ This is problematic, because ciphers tend to be more or less easily malleable, so non-signed messages can be tampered with; this is also an issue for encrypting files symmetrically ] (- Compression is on by default and makes everything super-slow for no good reason) - Widely used defaults for encryption and key derivation are rather arcane (eg. CAST5) - PGP signatures, by principle, are non-repudiatiable, unlike most modern encrypted chat applications, so they prove to _anyone_ _forever_ that your key signed that message. - PGP format announces all recipients to the world - No forward secrecy possible - ...
- criddell 10y ago
  Would the lack of perfect forward secrecy be considered a shortcoming?
dispose13432 10y ago
Web of Trust seems to be an inherently broken paradigm. Think about this. Let's say I trust my friends (so when my friends sign John Doe is John Doe, it's really him). It's a big deal (not every friend is so security conscious, maybe he met this guy on facebook and looks so real), but would I trust someone because of a friends-friend's recommendation? I know which friends are naive. But which friend's-friend's-friend is naive? And those are the only web-of-trust connection I have with him? Can I trust him? Can I not? How do I tell?
- subway 10y ago
  PGP already allows for this via "owner trust". When you sign a key, also indicate the level of trust you have in newly certified key's owner to certify other keys. It's of course up to you to decide who you can trust to certify other keys. edit: It's worth mentioning, "owner trust" is strictly a local attribute -- just because you fully trust John, and I fully trust you, my trust for John's certification of 3rd party keys remains unknown.
  - dispose13432 10y ago
    So let's go through a hypothetical situation: A has friend 1 and 2. He vets them, checks their ID, goes to a key-signing party, trusts that they are 1 and 2 with his life. Now he gets an email from "5000" who claims that he's from the IRS and needs to know information from you. You look up this "5000"s signature. Now, none of A's friends work in the IRS, but "5000" was signed by "500","302","201" and another 500 people. "302" was signed by "23", "23" was signed by "2". Should "A" send him the info? Theoretically, he can call "2", ask him how "2" knows "23", then call "23" on behalf of "2", and so on. But he doesn't know if "23" is honest, and all the more so "302". And what if "302" says that he knows who he is because he self-identified as "5000 from the IRS" at a bar? Too much thinking. Now imagine A is the kind of person who downloads EXEs to view cat pictures?
    - jandrese 10y ago
      At this point we should really be leveraging the (admittedly problematic at times) chain of trust built for the web. In an ideal world you could query the mail server for the domain in question for the person's keys using a simple HTTPS transfer. Verify the certificate is signed by a trusted party and issued to the domain in question, then request the public key for your destination. Sign the mail with that public key, and probably store it (or a fingerprint) so you can note any anomalous changes later. This could all be built into the mail client and happen at the click of a button. With an interface like this even your mother could use encrypted email. But it can't happen because someone will point out that the web of trust can't be trusted because governments could infiltrate it. Perfect has been the enemy of good in this system for decades.
hannob 10y ago
The crypto in OpenPGP is actually far from ideal. They combine some arcane block cipher mode with something called mdc ("modification detection code"), which isn't a proper authentication. It's kinda surprising that this hasn't caused more issues (though there were some authentication stripping attacks). It should switch to a proper AEAD mode. Also for RSA it is using PKCS #1 1.5 and SHA-1 is used all over the place. This is all not super serious, I wouldn't be too bothered about it. But it's not a solid crypto design by modern standards.

by SFJulie 10y ago

dom0 10y ago

> No one criticizes openPGP on the crypto point of view. Hm? Of course PGP is criticized for that, just less vocally. - Authentication is off by default in GPG - Even so, it's very complex, and most of the protocol isn't authenticated [ This is problematic, because ciphers tend to be more or less easily malleable, so non-signed messages can be tampered with; this is also an issue for encrypting files symmetrically ] (- Compression is on by default and makes everything super-slow for no good reason) - Widely used defaults for encryption and key derivation are rather arcane (eg. CAST5) - PGP signatures, by principle, are non-repudiatiable, unlike most modern encrypted chat applications, so they prove to _anyone_ _forever_ that your key signed that message. - PGP format announces all recipients to the world - No forward secrecy possible - ...

criddell 10y ago
Would the lack of perfect forward secrecy be considered a shortcoming?

dispose13432 10y ago

Web of Trust seems to be an inherently broken paradigm. Think about this. Let's say I trust my friends (so when my friends sign John Doe is John Doe, it's really him). It's a big deal (not every friend is so security conscious, maybe he met this guy on facebook and looks so real), but would I trust someone because of a friends-friend's recommendation? I know which friends are naive. But which friend's-friend's-friend is naive? And those are the only web-of-trust connection I have with him? Can I trust him? Can I not? How do I tell?

subway 10y ago
PGP already allows for this via "owner trust". When you sign a key, also indicate the level of trust you have in newly certified key's owner to certify other keys. It's of course up to you to decide who you can trust to certify other keys. edit: It's worth mentioning, "owner trust" is strictly a local attribute -- just because you fully trust John, and I fully trust you, my trust for John's certification of 3rd party keys remains unknown.
- dispose13432 10y ago
  So let's go through a hypothetical situation: A has friend 1 and 2. He vets them, checks their ID, goes to a key-signing party, trusts that they are 1 and 2 with his life. Now he gets an email from "5000" who claims that he's from the IRS and needs to know information from you. You look up this "5000"s signature. Now, none of A's friends work in the IRS, but "5000" was signed by "500","302","201" and another 500 people. "302" was signed by "23", "23" was signed by "2". Should "A" send him the info? Theoretically, he can call "2", ask him how "2" knows "23", then call "23" on behalf of "2", and so on. But he doesn't know if "23" is honest, and all the more so "302". And what if "302" says that he knows who he is because he self-identified as "5000 from the IRS" at a bar? Too much thinking. Now imagine A is the kind of person who downloads EXEs to view cat pictures?
  - jandrese 10y ago
    At this point we should really be leveraging the (admittedly problematic at times) chain of trust built for the web. In an ideal world you could query the mail server for the domain in question for the person's keys using a simple HTTPS transfer. Verify the certificate is signed by a trusted party and issued to the domain in question, then request the public key for your destination. Sign the mail with that public key, and probably store it (or a fingerprint) so you can note any anomalous changes later. This could all be built into the mail client and happen at the click of a button. With an interface like this even your mother could use encrypted email. But it can't happen because someone will point out that the web of trust can't be trusted because governments could infiltrate it. Perfect has been the enemy of good in this system for decades.

hannob 10y ago

The crypto in OpenPGP is actually far from ideal. They combine some arcane block cipher mode with something called mdc ("modification detection code"), which isn't a proper authentication. It's kinda surprising that this hasn't caused more issues (though there were some authentication stripping attacks). It should switch to a proper AEAD mode. Also for RSA it is using PKCS #1 1.5 and SHA-1 is used all over the place. This is all not super serious, I wouldn't be too bothered about it. But it's not a solid crypto design by modern standards.