4 ms·

The defaults he has chosen hints at a distro that ships GPG v1 / classic, which has stranger defaults than GPG v2. IIRC the default ciphers are CAST5, (very slo

The defaults he has chosen hints at a distro that ships GPG v1 / classic, which has stranger defaults than GPG v2. IIRC the default ciphers are CAST5, (very slow) compression is on by default, hashes are RIPEMD I believe and so on

acqq 10y ago
Exactly. The defaults of GPG 1, the one which can be used as a single not-too-big binary, seem to be poor. GPG 2 has better defaults, but it grew to include the kitchen sink and have a lot of moving parts, and I'd still prefer to have a good smaller program that does only a few things but do them good. My ideal would be a small executable with as little dependencies as possible.
- teddyh 10y ago
  Like gpgv or symcryptrun, maybe? https://gnupg.org/documentation/manuals/gnupg/gpgv.html#gpgv https://gnupg.org/documentation/manuals/gnupg/gpgv.html#gpgv https://gnupg.org/documentation/manuals/gnupg/symcryptrun.html#symcryptrun https://gnupg.org/documentation/manuals/gnupg/symcryptrun.ht...
- tptacek 10y ago
  The GPG1 defaults are definitely not great, but I'm not sure they have much practical impact for this use case.
  - acqq 10y ago
    What is "this use case" for you? The topic of the article is symmetric encryption, and whoever uses the defaults has much more chance to produce the files which could be compromised. it is a huge practical impact for me. Even when not using the defaults, the passphrases have to be really, really long to keep the content safe. http://security.stackexchange.com/questions/15632/what-is-purpose-of-s2k-gnupg-options http://security.stackexchange.com/questions/15632/what-is-pu... "In GnuPG 1.4.12 defaults are (found experimentally): --s2k-mode = 3 --s2k-digest-algo = SHA1 (supports MD5, RIPEMD-160, SHA2s too) --s2k-count = 65536 (supports from 1024 to 65011712) --s2k-cipher-algo = CAST5 (supports 3DES, CAST5, Blofish, AES, Twofish, Camellia too)"
    - tptacek 10y ago
      That's not at all true. Simple symmetric offline encryption of files is one of the few crypto operations that is easy to get right. The GPG1 defaults aren't great, but they aren't going to get your files compromised. And with the command line options presented upthread, you have the passphrase problem either way.
      - analogist 10y ago
        The symmetric algorithm aside, if we just look at the key derivation, the --s2k* parameters go up to 65011712 rounds of SHA512. If you maxed out the --s2k* settings, its difference from the 1.4.12 default of 65536 rounds of SHA1 is not staggering, but not trivial either: 10 extra bits from the additional rounds and an additional 3-4 bits from straight SHA1 to straight SHA512, on modern GPUs (https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...). An additional 13 bits of safety margin basically gives you an extra Diceware word (log2(7776)), which, I agree, isn't a magical solution at all, but would to me cross the threshold of "it has some actual impact". Of course, having much better usability for the average user, or just breaking OpenPGP compatibility so there are clean modern robust constructions like NaCl/libsodium running underneath are way better ways to get at good security margins, but here we are.
        acqq 10y ago
        Thanks a lot for the link, it's a wonderful overview of the password cracking capabilities of the modern GPUs.
      - acqq 10y ago
        > they aren't going to get your files compromised. The default encryption is CAST5 which is a 64-bit block size cipher (even if it is confusingly called "CAST-128"). The default password derivation is using SHA1. That's the reason people change the defaults. If you like them, you're of course free to use them or recommend them to your clients. Good luck. Of course I'd also like to read your explanation how you can consider 64-bits "secure enough" today (or for what you consider them secure enough). Also your estimate of how expensive would be to brute force shorter passwords for the traditionally small number of default rounds of SHA1. Thanks.
  - throwawayish 10y ago
    My main gripe with them is, apart from being a bit obscure, is that they're bog-slow. They give me something like two dozen MB/s encryption/decryption speed, on a machine that can do AEAD at 2.5-4 GB/s (AES-GCM or Chapoly). A large part of that is the compression (zlib-ish I think), though.

acqq 10y ago

Exactly. The defaults of GPG 1, the one which can be used as a single not-too-big binary, seem to be poor. GPG 2 has better defaults, but it grew to include the kitchen sink and have a lot of moving parts, and I'd still prefer to have a good smaller program that does only a few things but do them good. My ideal would be a small executable with as little dependencies as possible.

teddyh 10y ago
Like gpgv or symcryptrun, maybe? https://gnupg.org/documentation/manuals/gnupg/gpgv.html#gpgv https://gnupg.org/documentation/manuals/gnupg/gpgv.html#gpgv https://gnupg.org/documentation/manuals/gnupg/symcryptrun.html#symcryptrun https://gnupg.org/documentation/manuals/gnupg/symcryptrun.ht...
tptacek 10y ago
The GPG1 defaults are definitely not great, but I'm not sure they have much practical impact for this use case.
- acqq 10y ago
  What is "this use case" for you? The topic of the article is symmetric encryption, and whoever uses the defaults has much more chance to produce the files which could be compromised. it is a huge practical impact for me. Even when not using the defaults, the passphrases have to be really, really long to keep the content safe. http://security.stackexchange.com/questions/15632/what-is-purpose-of-s2k-gnupg-options http://security.stackexchange.com/questions/15632/what-is-pu... "In GnuPG 1.4.12 defaults are (found experimentally): --s2k-mode = 3 --s2k-digest-algo = SHA1 (supports MD5, RIPEMD-160, SHA2s too) --s2k-count = 65536 (supports from 1024 to 65011712) --s2k-cipher-algo = CAST5 (supports 3DES, CAST5, Blofish, AES, Twofish, Camellia too)"
  - tptacek 10y ago
    That's not at all true. Simple symmetric offline encryption of files is one of the few crypto operations that is easy to get right. The GPG1 defaults aren't great, but they aren't going to get your files compromised. And with the command line options presented upthread, you have the passphrase problem either way.
    - analogist 10y ago
      The symmetric algorithm aside, if we just look at the key derivation, the --s2k* parameters go up to 65011712 rounds of SHA512. If you maxed out the --s2k* settings, its difference from the 1.4.12 default of 65536 rounds of SHA1 is not staggering, but not trivial either: 10 extra bits from the additional rounds and an additional 3-4 bits from straight SHA1 to straight SHA512, on modern GPUs (https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...). An additional 13 bits of safety margin basically gives you an extra Diceware word (log2(7776)), which, I agree, isn't a magical solution at all, but would to me cross the threshold of "it has some actual impact". Of course, having much better usability for the average user, or just breaking OpenPGP compatibility so there are clean modern robust constructions like NaCl/libsodium running underneath are way better ways to get at good security margins, but here we are.
      - acqq 10y ago
        Thanks a lot for the link, it's a wonderful overview of the password cracking capabilities of the modern GPUs.
    - acqq 10y ago
      > they aren't going to get your files compromised. The default encryption is CAST5 which is a 64-bit block size cipher (even if it is confusingly called "CAST-128"). The default password derivation is using SHA1. That's the reason people change the defaults. If you like them, you're of course free to use them or recommend them to your clients. Good luck. Of course I'd also like to read your explanation how you can consider 64-bits "secure enough" today (or for what you consider them secure enough). Also your estimate of how expensive would be to brute force shorter passwords for the traditionally small number of default rounds of SHA1. Thanks.
- throwawayish 10y ago
  My main gripe with them is, apart from being a bit obscure, is that they're bog-slow. They give me something like two dozen MB/s encryption/decryption speed, on a machine that can do AEAD at 2.5-4 GB/s (AES-GCM or Chapoly). A large part of that is the compression (zlib-ish I think), though.