8 ms·

OpenPGPjs v3.0

199 points by vabmit 9y ago

vabmit 9y ago
In case anyone that doesn't follow the development of the library closely missed it, the main improvement in this version is the introduction of ECC support. ECC tends to be able to provide equivalent levels of security as traditional "big prime" cryptography (like RSA) with less computationally intensive operations. This is especially important in a library like OpenPGPjs that is primarily meant for in browser based web usage because it should make things, like sending and receiving mail, faster when ECC is used over older PGP public key encryption systems. For people that use ProtonMail's web based crypto on mobile or tablet devices, a switch to ECC would result not just in similar performance improvements but also in lower battery usage. Currently, ProtonMail uses RSA keys, but this addition of ECC support to their web encryption library may mean that they are about to start switching users to ECC keys. Because using "larger" (when compared with equivalent theoretical strength RSA keys, for example) ECC keys is less resource intensive than using higher security keys in some other forms of cryptosystems (like RSA) it may also be an indication that ProtonMail is preparing to upgrade users to higher security/stronger keys. Many cryptographers and organizations, including the US Government, have recommended for a long time that people migrate from older "big prime cryptography" based cryptosystems to ECC based cryptosystems for increased security.
- dsacco 9y ago
  > In case anyone that doesn't follow the development of the library closely missed it, the main improvement in this version is the introduction of ECC support. Wow...I'm sort of shocked that wasn't a v1.0 consideration. > ECC tends to be able to provide equivalent levels of security as traditional "big prime" cryptography (like RSA) with less computationally intensive operations. This is especially important in a library like OpenPGPjs that is primarily meant for in browser based web usage because it should make things, like sending and receiving mail, faster when ECC is used over older PGP public key encryption systems. For people that use ProtonMail's web based crypto on mobile or tablet devices, a switch to ECC would result not just in similar performance improvements but also in lower battery usage. In particular, elliptic curves have smaller parameters, which allow for smaller keys at the same bit security level. For example, to achieve 128-bit security, an RSA/DLP modulus must be 3072 bits. Elliptic curves achieve the same security level with only 256-bit parameters. They are also faster for most operations, but RSA is still technically faster for signature verification. > Many cryptographers and organizations, including the US Government, have recommended for a long time that people migrate from older "big prime cryptography" based cryptosystems to ECC based cryptosystems for increased security. True, but elliptic curve cryptography is just as vulnerable to quantum computers, however long off that problem may be.
  - zahllos 9y ago
    > Wow...I'm sort of shocked that wasn't a v1.0 consideration. Given that you need to pass --expert to gpg 2.1 as of right now to even generate an ECC keypair for PGP use (nor use one on an OpenPGP smartcard or yubikey), I can sort of forgive the lack of ECC in 1.0. I don't think it sees wide usage for PGP keys (some clients don't support it, also). However, as of the last time I tried Protonmail (about 10 minutes ago to check this is all still true) you can't: revoke/reissue your PGP key, validate outside signatures (either on encrypted messages or signed, plaintext messages) or send pure-PGP mail to users outside of protonmail (there's an encrypt for non-protonmail users option, that sends a link instead). Essentially as another commenter has said, you can't really do PGP with ProtonMail.
    - bartbutler 9y ago
      This is about to change dramatically.
    - jlgaddis 9y ago
      I don't use ProtoMail but it sounds like they are "managing" users' private keys!? Am I understanding this correctly? ProtonMail has access to their users' private keys? And they are using web-based encryption, delivered via JavaScript? And people trust them!?
  - wslh 9y ago
    > Wow...I'm sort of shocked that wasn't a v1.0 consideration. My company contributed the ECC support for enabling messaging using the same keys as Bitcoin and other cryptocurrencies. See https://news.ycombinator.com/item?id=16548015 https://news.ycombinator.com/item?id=16548015
  - kfrzcode 9y ago
    Aren't there multiple operating quantum computers right now? Isn't this a very imminent problem?
    - bartbutler 9y ago
- Shoothe 9y ago
  > Many cryptographers and organizations, including the US Government, have recommended for a long time that people migrate from older "big prime cryptography" based cryptosystems to ECC based cryptosystems for increased security. Personally I'd stay away from NIST recommended curves for long term keys (as used in OpenPGP). Ed25519 looks nice and there is experimental support for it in gnupg but it's not post quantum unfortunately.
  - dsacco 9y ago
    > Ed25519 looks nice and there is experimental support for it in gnupg but it's not post quantum unfortunately. That's not a problem of NIST recommendations. There aren't any post-quantum secure elliptic curve public-key systems. The fundamental computational problem used by ECC public-key cryptography isn't post-quantum secure, so it's not really a matter of curve choice.
    - Shoothe 9y ago
      The problem with NIST curves (vs ed25519) is the choice of parameters (it is not clear why they have such and such values) and the implementation edge cases. You already know it but maybe someone else will find it interesting: https://safecurves.cr.yp.to/ https://safecurves.cr.yp.to/ The comment about post quantum crypto did not relate to ECC directly. I just would like to see some PQ crypto in OpenPGP :)
- chapill 9y ago
  >Many cryptographers and organizations, including the US Government, have recommended for a long time that people migrate from older "big prime cryptography" based cryptosystems to ECC based cryptosystems for increased security. Not what I've heard. https://threatpost.com/nsas-divorce-from-ecc-causing-crypto-hand-wringing/115150/ https://threatpost.com/nsas-divorce-from-ecc-causing-crypto-...
sphix0r 9y ago
Great to see protonmail working on this. It's shocking how much sensitive data is sent by mail (contracts, passwords, lawyers, etc..) without pgp signing / encryption on a daily basis.
WhatIsDukkha 9y ago
I wish something like this would take off - https://github.com/kylehuff/webpg-chrome https://github.com/kylehuff/webpg-chrome We deserve a better userspace from our browsers. The excuse that "users" don't want this because its "hard" is circular.
- theli0nheart 9y ago
  The project looks really cool! But...the fact that the website has a certificate error doesn't inspire much confidence. Especially since it's a security tool. :(
  - bartbutler 9y ago
    What certificate error? Neither https://openpgpjs.org https://openpgpjs.org nor the link here have a certificate error for me. Maybe you are being MITMed...
    - jonnydubowsky 9y ago
      I got a certificate error as well. This site hasn't had its certification for 132 days. I thought the whole link was a super meta joke/test. It does look cool though. Thanks for posting.
    - jolmg 9y ago
      I'm also getting it. The certificate for https://webpg.org/ https://webpg.org/ expired October 29, 2017.
      - bartbutler 9y ago
        Aha, I misunderstood the original comment.
    - deleted 9y ago
      [deleted]
  - ReverseCold 9y ago
xs 9y ago
I don't get it. Protonmail still doesn't support PGP, yet they're working on open source libraries for other people to implement PGP? I don't understand these priorities.
- vabmit 9y ago
  What do you mean "ProtonMail still doesn't support PGP"? You mean sending PGP encrypted e-mails to non-protonmail addresses?
  - pzduniak 9y ago
    Yeah, ProtonMail's really a closed garden unfortunately.
- protonmail 9y ago
  The library is the prerequisite for proper PGP support in ProtonMail, so it obviously needs to be built first.
  - pzduniak 9y ago
    You mean the library that you've been using from the beginning of the proper web client? This is not an answer. Kudos for finally doing ECC though.
    - bartbutler 9y ago
      For internal use we had all RSA keys so it was fine. For external use we have to support what everyone uses, and there is a variety as you know. Saying "hey, you can use PGP but all your friends have to have RSA keys" is not a recipe for a good user experience.
      - e12e 9y ago
        This is great to hear! If/when protonmail transitions to be mail host that support open standards in a wider sense, I'd more seriously consider becoming a customer :-) Fwiw, while I'm not that interested in the current project - I actually think it's great to build a walled garden on open standards - especially for secure services. Makes it easier to evaluate, and opens the door fore secure interop in the future.
dfabulich 9y ago
What is the threat model for PGP in JS? Like, is there an Alice, Bob, Carol, Eve story under which PGP in JS makes sense? The canonical example that IMO doesn't make sense is when Alice and Bob want to communicate privately using Eve as an webmail provider who wants to snoop in on the communications. Alice and Bob can't just trust Eve to provide a copy of OpenPGPjs in a <script> tag on EveMail.com, because then they're trusting Eve to provide a legitimate PGP implementation, trusting Eve not to log their keystrokes in JS, etc. I can understand OpenPGPjs as a server-side library in Node (though I suspect it would be safer to run a battle-hardened library like GPG with node FFI). But, in client-side web code, how could this ever make sense?
- crispyporkbites 9y ago
  Subresource integrity means you could trust Eve in some cases. Also if Eve provides a script tag from a trusted CDN it could work. You would have to check it every time though. What might help is a browser extension that tracks changes and allows you to “lock” into a version of a website.
  - e12e 9y ago
    Technically Sri only reduces the amount of trusted data you need to keep around; you'd need an index.html that loads gpg.js and a js client that talks to a server (eg: jmap or a bespoke jsonapi that allows getting/sending mail). This is pretty much what browser extensions do; bottle up some hypertext resources, signed and versioned. You still have three obvious threats: local superuser can read application memory etc; your local user can read your memory and any browser compromise/bug can likely read your browser/session data. The real question is if the browser sandbox is ever likely to be good enough that you don't have to worry about a font file from a compromised website about kittens reading your email in another tab.
- dmos62 9y ago
  I've been looking for gmail alternatives and this is my conclusion. Protonmail plays the part of the secure and private email provider, but, technologically, can't provide that. The only concrete thing their users have going is the superior legal environment of Switzerland. A less-than-concrete comforter is that if we believe that the people behind Protonmail believe in privacy, we'll tend to think they're more likely to try to protect ours if push comes to shove. This makes me look for alternatives.
woranl 9y ago
Why not use webcrypto instead?
- Shoothe 9y ago
  They are probably using it underneath. Webcrypto by itself is just a set of primitives, you need a higher level abstractions to do anything useful in real world.

199 points by vabmit 9y ago

In case anyone that doesn't follow the development of the library closely missed it, the main improvement in this version is the introduction of ECC support. ECC tends to be able to provide equivalent levels of security as traditional "big prime" cryptography (like RSA) with less computationally intensive operations. This is especially important in a library like OpenPGPjs that is primarily meant for in browser based web usage because it should make things, like sending and receiving mail, faster when ECC is used over older PGP public key encryption systems. For people that use ProtonMail's web based crypto on mobile or tablet devices, a switch to ECC would result not just in similar performance improvements but also in lower battery usage. Currently, ProtonMail uses RSA keys, but this addition of ECC support to their web encryption library may mean that they are about to start switching users to ECC keys. Because using "larger" (when compared with equivalent theoretical strength RSA keys, for example) ECC keys is less resource intensive than using higher security keys in some other forms of cryptosystems (like RSA) it may also be an indication that ProtonMail is preparing to upgrade users to higher security/stronger keys. Many cryptographers and organizations, including the US Government, have recommended for a long time that people migrate from older "big prime cryptography" based cryptosystems to ECC based cryptosystems for increased security.

dsacco 9y ago
> In case anyone that doesn't follow the development of the library closely missed it, the main improvement in this version is the introduction of ECC support. Wow...I'm sort of shocked that wasn't a v1.0 consideration. > ECC tends to be able to provide equivalent levels of security as traditional "big prime" cryptography (like RSA) with less computationally intensive operations. This is especially important in a library like OpenPGPjs that is primarily meant for in browser based web usage because it should make things, like sending and receiving mail, faster when ECC is used over older PGP public key encryption systems. For people that use ProtonMail's web based crypto on mobile or tablet devices, a switch to ECC would result not just in similar performance improvements but also in lower battery usage. In particular, elliptic curves have smaller parameters, which allow for smaller keys at the same bit security level. For example, to achieve 128-bit security, an RSA/DLP modulus must be 3072 bits. Elliptic curves achieve the same security level with only 256-bit parameters. They are also faster for most operations, but RSA is still technically faster for signature verification. > Many cryptographers and organizations, including the US Government, have recommended for a long time that people migrate from older "big prime cryptography" based cryptosystems to ECC based cryptosystems for increased security. True, but elliptic curve cryptography is just as vulnerable to quantum computers, however long off that problem may be.
- zahllos 9y ago
  > Wow...I'm sort of shocked that wasn't a v1.0 consideration. Given that you need to pass --expert to gpg 2.1 as of right now to even generate an ECC keypair for PGP use (nor use one on an OpenPGP smartcard or yubikey), I can sort of forgive the lack of ECC in 1.0. I don't think it sees wide usage for PGP keys (some clients don't support it, also). However, as of the last time I tried Protonmail (about 10 minutes ago to check this is all still true) you can't: revoke/reissue your PGP key, validate outside signatures (either on encrypted messages or signed, plaintext messages) or send pure-PGP mail to users outside of protonmail (there's an encrypt for non-protonmail users option, that sends a link instead). Essentially as another commenter has said, you can't really do PGP with ProtonMail.
  - bartbutler 9y ago
    This is about to change dramatically.
  - jlgaddis 9y ago
    I don't use ProtoMail but it sounds like they are "managing" users' private keys!? Am I understanding this correctly? ProtonMail has access to their users' private keys? And they are using web-based encryption, delivered via JavaScript? And people trust them!?
- wslh 9y ago
  > Wow...I'm sort of shocked that wasn't a v1.0 consideration. My company contributed the ECC support for enabling messaging using the same keys as Bitcoin and other cryptocurrencies. See https://news.ycombinator.com/item?id=16548015 https://news.ycombinator.com/item?id=16548015
- kfrzcode 9y ago
  Aren't there multiple operating quantum computers right now? Isn't this a very imminent problem?
  - bartbutler 9y ago
Shoothe 9y ago
> Many cryptographers and organizations, including the US Government, have recommended for a long time that people migrate from older "big prime cryptography" based cryptosystems to ECC based cryptosystems for increased security. Personally I'd stay away from NIST recommended curves for long term keys (as used in OpenPGP). Ed25519 looks nice and there is experimental support for it in gnupg but it's not post quantum unfortunately.
- dsacco 9y ago
  > Ed25519 looks nice and there is experimental support for it in gnupg but it's not post quantum unfortunately. That's not a problem of NIST recommendations. There aren't any post-quantum secure elliptic curve public-key systems. The fundamental computational problem used by ECC public-key cryptography isn't post-quantum secure, so it's not really a matter of curve choice.
  - Shoothe 9y ago
    The problem with NIST curves (vs ed25519) is the choice of parameters (it is not clear why they have such and such values) and the implementation edge cases. You already know it but maybe someone else will find it interesting: https://safecurves.cr.yp.to/ https://safecurves.cr.yp.to/ The comment about post quantum crypto did not relate to ECC directly. I just would like to see some PQ crypto in OpenPGP :)
chapill 9y ago
>Many cryptographers and organizations, including the US Government, have recommended for a long time that people migrate from older "big prime cryptography" based cryptosystems to ECC based cryptosystems for increased security. Not what I've heard. https://threatpost.com/nsas-divorce-from-ecc-causing-crypto-hand-wringing/115150/ https://threatpost.com/nsas-divorce-from-ecc-causing-crypto-...

sphix0r 9y ago

Great to see protonmail working on this. It's shocking how much sensitive data is sent by mail (contracts, passwords, lawyers, etc..) without pgp signing / encryption on a daily basis.

WhatIsDukkha 9y ago

I wish something like this would take off - https://github.com/kylehuff/webpg-chrome https://github.com/kylehuff/webpg-chrome We deserve a better userspace from our browsers. The excuse that "users" don't want this because its "hard" is circular.

theli0nheart 9y ago
The project looks really cool! But...the fact that the website has a certificate error doesn't inspire much confidence. Especially since it's a security tool. :(
- bartbutler 9y ago
  What certificate error? Neither https://openpgpjs.org https://openpgpjs.org nor the link here have a certificate error for me. Maybe you are being MITMed...
  - jonnydubowsky 9y ago
    I got a certificate error as well. This site hasn't had its certification for 132 days. I thought the whole link was a super meta joke/test. It does look cool though. Thanks for posting.
  - jolmg 9y ago
    I'm also getting it. The certificate for https://webpg.org/ https://webpg.org/ expired October 29, 2017.
    - bartbutler 9y ago
      Aha, I misunderstood the original comment.
  - deleted 9y ago
    [deleted]
- ReverseCold 9y ago

xs 9y ago

I don't get it. Protonmail still doesn't support PGP, yet they're working on open source libraries for other people to implement PGP? I don't understand these priorities.

vabmit 9y ago
What do you mean "ProtonMail still doesn't support PGP"? You mean sending PGP encrypted e-mails to non-protonmail addresses?
- pzduniak 9y ago
  Yeah, ProtonMail's really a closed garden unfortunately.
protonmail 9y ago
The library is the prerequisite for proper PGP support in ProtonMail, so it obviously needs to be built first.
- pzduniak 9y ago
  You mean the library that you've been using from the beginning of the proper web client? This is not an answer. Kudos for finally doing ECC though.
  - bartbutler 9y ago
    For internal use we had all RSA keys so it was fine. For external use we have to support what everyone uses, and there is a variety as you know. Saying "hey, you can use PGP but all your friends have to have RSA keys" is not a recipe for a good user experience.
    - e12e 9y ago
      This is great to hear! If/when protonmail transitions to be mail host that support open standards in a wider sense, I'd more seriously consider becoming a customer :-) Fwiw, while I'm not that interested in the current project - I actually think it's great to build a walled garden on open standards - especially for secure services. Makes it easier to evaluate, and opens the door fore secure interop in the future.

dfabulich 9y ago

What is the threat model for PGP in JS? Like, is there an Alice, Bob, Carol, Eve story under which PGP in JS makes sense? The canonical example that IMO doesn't make sense is when Alice and Bob want to communicate privately using Eve as an webmail provider who wants to snoop in on the communications. Alice and Bob can't just trust Eve to provide a copy of OpenPGPjs in a <script> tag on EveMail.com, because then they're trusting Eve to provide a legitimate PGP implementation, trusting Eve not to log their keystrokes in JS, etc. I can understand OpenPGPjs as a server-side library in Node (though I suspect it would be safer to run a battle-hardened library like GPG with node FFI). But, in client-side web code, how could this ever make sense?

crispyporkbites 9y ago
Subresource integrity means you could trust Eve in some cases. Also if Eve provides a script tag from a trusted CDN it could work. You would have to check it every time though. What might help is a browser extension that tracks changes and allows you to “lock” into a version of a website.
- e12e 9y ago
  Technically Sri only reduces the amount of trusted data you need to keep around; you'd need an index.html that loads gpg.js and a js client that talks to a server (eg: jmap or a bespoke jsonapi that allows getting/sending mail). This is pretty much what browser extensions do; bottle up some hypertext resources, signed and versioned. You still have three obvious threats: local superuser can read application memory etc; your local user can read your memory and any browser compromise/bug can likely read your browser/session data. The real question is if the browser sandbox is ever likely to be good enough that you don't have to worry about a font file from a compromised website about kittens reading your email in another tab.
dmos62 9y ago
I've been looking for gmail alternatives and this is my conclusion. Protonmail plays the part of the secure and private email provider, but, technologically, can't provide that. The only concrete thing their users have going is the superior legal environment of Switzerland. A less-than-concrete comforter is that if we believe that the people behind Protonmail believe in privacy, we'll tend to think they're more likely to try to protect ours if push comes to shove. This makes me look for alternatives.

woranl 9y ago

Why not use webcrypto instead?

Shoothe 9y ago
They are probably using it underneath. Webcrypto by itself is just a set of primitives, you need a higher level abstractions to do anything useful in real world.