4 ms·

Thanks for the explanation! Do you know why GNUK (the open source project used by Nitrokey and some other smart cards) chooses not to support U2F? I don't unde

Thanks for the explanation! Do you know why GNUK (the open source project used by Nitrokey and some other smart cards) chooses not to support U2F? I don't understand the maintainer's criticisms[0] and I'd like to probe someone knowledgeable to find out more. [0] https://lists.gnupg.org/pipermail/gnupg-users/2017-March/057850.html https://lists.gnupg.org/pipermail/gnupg-users/2017-March/057...

klodolph 8y ago
I am having some trouble understanding as well. Here is what I understand. The point of GNUK is to move your GnuPG private key to a more secure device so it doesn't have to sit on your computer. With GnuPG, users are basically in control of the cryptographic operations: what keys to trust, what to encrypt or decrypt, etc. With U2F, in order to comply with the spec you are basically forced to make a bunch of decisions that don't necessarily line up with GNUK's goals. You have to trust X.509 certificates and the whole PKI starting from your browser (CA roots and all that). Plus, U2F is basically a cheaper alternative to client certificates, but with GNUK you already have client certificates, so why go with something that provides less security? To elaborate: With GnuPG, the reason you trust that Alice is really Alice is because you signed her public key with your private key. You can then secure your private key on a hardware device with GNUK. With FIDO U2F and GMail, you have to trust that you are accessing GMail, which is done through pinned certificates and a chain of trust starting from a public CA root. This system doesn't offer you much granularity for trusting certificates. Adding FIDO U2F to a system designed to support a GnuPG-like model of trust dilutes the purpose of the device. By analogy, imagine if you used your credit card to log in to GMail, maybe by using it as the secret key for U2F. The analogy isn't great, but you can imagine that even if you can trust that (through the protocol) GMail can't steal your credit card number, the fact that you are waving your credit card about all the time makes it a little less secure. In general, people who work on GnuPG and other similar cryptography systems tend to be critical of the whole PKI, and I'm sympathetic to that viewpoint.
- tialaramex 8y ago
  U2F really, really isn't at all like client certificates. The certs baked into tokens are for _batches_ the specification says (and famous implementations like those from Yubico do this) that a batch of thousands of similar keys should have the same certificate, it exists to say e.g. "This is a Genuine Mattel Girl Power FIDO Token" versus "This a Bank Corp. Banking Bank Security Token". Relying parties are discouraged from examining it, since in most cases there's no reason to care. Unlike your GnuPG key, the FIDO token isn't an identity. The token is designed so that a particular domain can verify that it is talking to the same token it talked to last time, but nothing more. So e.g. if you use your GnuPG key for PornHub, GitHub and Facebook, anyone with access to all three systems can figure out that it's the same person. Whereas if you use the same FIDO token, that's invisible even to someone with full backend access to all three systems.
- jancsika 8y ago
  In the last GNU related post about Emacs, a security person suggested changing defaults related to TLS to address many of the known dangers with the current PKI situation. There, the lead developer apparently didn't want to change the defaults because that would somehow be top-down aggression against user choice in the style of the TSA at the airport. Here, you are saying that GNUK won't add FIDO U2F because the lead dev is critical of the whole PKI system. Thus, the GNUK user doesn't get defaults which allow them to easily bootstrap into the web services that are used by a large portion of the population. I mean, that's fine and justifiable as individual projects go. But one could just as easily imagine the approach of these two projects switched so that Emacs reflexively reacted by choosing the most secure TLS settings for defaults, and GNUK being liberal with which protocols they add. So what's the point of the Gnu umbrella if users and potential devs essentially roll a roulette wheel to guess how each developerbase prioritizes something as critical as security?

klodolph 8y ago

I am having some trouble understanding as well. Here is what I understand. The point of GNUK is to move your GnuPG private key to a more secure device so it doesn't have to sit on your computer. With GnuPG, users are basically in control of the cryptographic operations: what keys to trust, what to encrypt or decrypt, etc. With U2F, in order to comply with the spec you are basically forced to make a bunch of decisions that don't necessarily line up with GNUK's goals. You have to trust X.509 certificates and the whole PKI starting from your browser (CA roots and all that). Plus, U2F is basically a cheaper alternative to client certificates, but with GNUK you already have client certificates, so why go with something that provides less security? To elaborate: With GnuPG, the reason you trust that Alice is really Alice is because you signed her public key with your private key. You can then secure your private key on a hardware device with GNUK. With FIDO U2F and GMail, you have to trust that you are accessing GMail, which is done through pinned certificates and a chain of trust starting from a public CA root. This system doesn't offer you much granularity for trusting certificates. Adding FIDO U2F to a system designed to support a GnuPG-like model of trust dilutes the purpose of the device. By analogy, imagine if you used your credit card to log in to GMail, maybe by using it as the secret key for U2F. The analogy isn't great, but you can imagine that even if you can trust that (through the protocol) GMail can't steal your credit card number, the fact that you are waving your credit card about all the time makes it a little less secure. In general, people who work on GnuPG and other similar cryptography systems tend to be critical of the whole PKI, and I'm sympathetic to that viewpoint.

tialaramex 8y ago
U2F really, really isn't at all like client certificates. The certs baked into tokens are for _batches_ the specification says (and famous implementations like those from Yubico do this) that a batch of thousands of similar keys should have the same certificate, it exists to say e.g. "This is a Genuine Mattel Girl Power FIDO Token" versus "This a Bank Corp. Banking Bank Security Token". Relying parties are discouraged from examining it, since in most cases there's no reason to care. Unlike your GnuPG key, the FIDO token isn't an identity. The token is designed so that a particular domain can verify that it is talking to the same token it talked to last time, but nothing more. So e.g. if you use your GnuPG key for PornHub, GitHub and Facebook, anyone with access to all three systems can figure out that it's the same person. Whereas if you use the same FIDO token, that's invisible even to someone with full backend access to all three systems.
jancsika 8y ago
In the last GNU related post about Emacs, a security person suggested changing defaults related to TLS to address many of the known dangers with the current PKI situation. There, the lead developer apparently didn't want to change the defaults because that would somehow be top-down aggression against user choice in the style of the TSA at the airport. Here, you are saying that GNUK won't add FIDO U2F because the lead dev is critical of the whole PKI system. Thus, the GNUK user doesn't get defaults which allow them to easily bootstrap into the web services that are used by a large portion of the population. I mean, that's fine and justifiable as individual projects go. But one could just as easily imagine the approach of these two projects switched so that Emacs reflexively reacted by choosing the most secure TLS settings for defaults, and GNUK being liberal with which protocols they add. So what's the point of the Gnu umbrella if users and potential devs essentially roll a roulette wheel to guess how each developerbase prioritizes something as critical as security?