3 ms·

Can you elaborate on what you mean by (1-2) leaking meta-information and making deniability difficult? Do you mean that even when choosing to encrypt but not si

Can you elaborate on what you mean by (1-2) leaking meta-information and making deniability difficult? Do you mean that even when choosing to encrypt but not sign I am leaking definite proof (like a signature) of my private key information in the encrypted message? That seems hard to believe unless I am misunderstanding you, because my experience is that any private key use requires auth from my Yubikey and yet I can do encryption without my yubikey plugged in at all. edit: If by deniability you're talking about PFS, then, well, don't sign something you want to be able to deny having signed. I feel your comment might be misinterpreted to be a critique of PGP encryption when really it's a critique of PFS of PGP signatures+encryption.

valarauca1 8y ago
Your public key is always clear text, or at a minimum your public key finger print (which can be used via a key-server to find your personal information and public key). So GnuPG to a degree makes it difficult to hide metadata about yourself as many tools will send your public key + data to a key server as soon as they create your key-pair. This is so when people verify you, your easier to find. This creates a chicken-in-the-box metadata problem where for people to very your public GnuPG public-key is really you that info has to be public, but for anonymity it can't be .
- tanderson92 8y ago
  This is all true, but is a different question from deniability when sending messages, and leaking metadata when sending information, which is what tptacek claimed: > ...in particular, it's difficult to send deniable messages with it. It's easy (unless tptacek is mentioning an attack I am unaware of) to ensure deniability -- encrypt but don't sign.
  - jancsika 8y ago
    Not sure what OP was getting at (maybe the difficulty of deniability using GPG/GPG-encrypted mail defaults), but you'd still be sending to a recipient's long-lived public key. That's practically different than a system like OTR that has forward secrecy by default.
    - tanderson92 8y ago
      Since anyone in the world can encrypt to a PGP public key, deniability is trivial. It is true that some systems (like enigmail) also encrypt to your own public key when sending messages, but this is also easily deniable.
  - Dylan16807 8y ago
    You usually want the recipient to be able to verify the sender, but not be able to prove it to a third party. Throwing away authentication entirely is a pretty baby-with-the-bathwater solution to deniability.
tedunangst 8y ago
I think the assumption is that authentication is bare minimum for a secure messaging system, so "just don't sign" isn't really an option.
- tanderson92 8y ago
  Well okay but he said "message encryption"; everyone is reading into that to mean authentication as well but I don't know why we should extend that understanding when a plain reading of his post implies a harsher critique of PGP encryption than warranted. It's also amusing how many people downvoted me for disagreeing with tptacek.

valarauca1 8y ago

Your public key is always clear text, or at a minimum your public key finger print (which can be used via a key-server to find your personal information and public key). So GnuPG to a degree makes it difficult to hide metadata about yourself as many tools will send your public key + data to a key server as soon as they create your key-pair. This is so when people verify you, your easier to find. This creates a chicken-in-the-box metadata problem where for people to very your public GnuPG public-key is really you that info has to be public, but for anonymity it can't be .

tanderson92 8y ago
This is all true, but is a different question from deniability when sending messages, and leaking metadata when sending information, which is what tptacek claimed: > ...in particular, it's difficult to send deniable messages with it. It's easy (unless tptacek is mentioning an attack I am unaware of) to ensure deniability -- encrypt but don't sign.
- jancsika 8y ago
  Not sure what OP was getting at (maybe the difficulty of deniability using GPG/GPG-encrypted mail defaults), but you'd still be sending to a recipient's long-lived public key. That's practically different than a system like OTR that has forward secrecy by default.
  - tanderson92 8y ago
    Since anyone in the world can encrypt to a PGP public key, deniability is trivial. It is true that some systems (like enigmail) also encrypt to your own public key when sending messages, but this is also easily deniable.
- Dylan16807 8y ago
  You usually want the recipient to be able to verify the sender, but not be able to prove it to a third party. Throwing away authentication entirely is a pretty baby-with-the-bathwater solution to deniability.

tedunangst 8y ago

I think the assumption is that authentication is bare minimum for a secure messaging system, so "just don't sign" isn't really an option.

tanderson92 8y ago
Well okay but he said "message encryption"; everyone is reading into that to mean authentication as well but I don't know why we should extend that understanding when a plain reading of his post implies a harsher critique of PGP encryption than warranted. It's also amusing how many people downvoted me for disagreeing with tptacek.