5 ms·

Is OpenPGP considered 'legacy'? If so, why? I was under the impression that it's mostly that it's really hart to reliably support e.g. calling 'gnupg' (cmdline

Is OpenPGP considered 'legacy'? If so, why? I was under the impression that it's mostly that it's really hart to reliably support e.g. calling 'gnupg' (cmdline), gpgme (library), etc.? ISTR there was a company that's re-implementing the OpenPGP standard from scratch in a library-oriented-fashion, but for the life of me I can't remember their name... I don't disagree with the 'drop legacy' stance, btw, I'm just interested in what exactly the issue is.

tptacek 8y ago
Yes, as the article says, it's a 1990s-style ultra-configurable do-everything design which, in practice, almost always gets deployed in a lowest-common-denominator set of constructions that are themselves mired in 1990s crypto. No modern cryptographic engineer looking at any problem PGP solves would design a system that looked like PGP. PGP used to make some sense as a simple at-rest storage format, but in the era of Nacl and libsodium, even that use case is a poor fit.
- Quekid5 8y ago
  Fair enough, I suppose. I'm not sure it's just me being behind the times, but it seems that quite a few of the ideas behind PGP (specifically: asymmetric encryption) aren't really being exploited seriously. Instead there's lots of halfhearted "oh, let's just encrypt thing X with a password stored in thing Y" where Y is presumably more 'secure'. This is a bit of a tangent, but I find it interesting and depressing that industry has learned very little, if anything.
  - tptacek 8y ago
    This article explicitly points out modern alternatives to PGP's clunky, 1990s implementation of asymmetric encryption. But, tangentially, it's a bad idea to use asymmetric encryption when you don't absolutely need it. Modern symmetric AEAD ciphers, which are implicated in pretty much all serious public-key designs anyways, are safer to use that asymmetric cryptography. Seeing a public key in a design that doesn't demand public keys is a cryptographic engineering code smell.
- tyingq 8y ago
  I believe "gpg -c" remains a better idea than encrypted zip files and "openssl enc" due to better defaults/ciphers/kdf. The article mentions magic wormhole, but sometimes you need plain old symmetric file encryption with a password.
  - tptacek 8y ago
    Yes, PGP is better than the Bass-o-matic ZIP cipher many implementations of ZIP use. PGP clears that very, very low bar.
    - tyingq 8y ago
      I did mention "openssl enc" as well. Is there some other common bundled utility I missed? Or it's not useful to compare what's at hand? Not sure I'm getting the message behind the jab.
      - tptacek 8y ago
        "openssl enc" requires you to select from over 105 different cipher constructions, virtually all of which are terribly insecure.
        deleted 8y ago
        [deleted]
        tyingq 8y ago
        Okay, so "gpg -c" is better than other commonly installed command line tools for encrypting a file with password?
        tptacek 8y ago
        PGP, which is something you have to explicitly install, is a badly flawed way to encrypt files; it has a poor password KDF and you should look at how it authenticates data. Install something better.
- _wldu 8y ago
  tptacek - What would you consider a good modern way to replace encrypting large text files to multiple PGP keys? That's my main automated use case for OpenPGP in Go. If there is a simpler, more modern way, I'd like to try it... thanks. Edit: We do this, then push the files to a S3 bucket and users can get the files and decrypt them without having to deal with remembering/forgetting static passwords.
  - deleted 8y ago
    [deleted]
  - sa2ajj 8y ago
    sorry, I misremembered the tool. there's one that serves your purpose, however I do not remember the name at this time.
  - w8rbt 8y ago
    Replying to myself... I think I could actually use nacl/box to accomplish this. I'd just have to take care and break the large files into smaller chunks and find a way for users to easily generate and manage keys. OpenPGP sort of makes key mgt easy.
- mikegerwitz 8y ago
  PGP is still widely deployed, whether you like it or not. "I don't like it" isn't a valid argument for considering something "legacy", when it works just fine for certain cases.
  - tptacek 8y ago
    "I don't like it" isn't my argument for OpenPGP being legacy, and there's nothing in this thread to suggest otherwise.

tptacek 8y ago

Yes, as the article says, it's a 1990s-style ultra-configurable do-everything design which, in practice, almost always gets deployed in a lowest-common-denominator set of constructions that are themselves mired in 1990s crypto. No modern cryptographic engineer looking at any problem PGP solves would design a system that looked like PGP. PGP used to make some sense as a simple at-rest storage format, but in the era of Nacl and libsodium, even that use case is a poor fit.

Quekid5 8y ago
Fair enough, I suppose. I'm not sure it's just me being behind the times, but it seems that quite a few of the ideas behind PGP (specifically: asymmetric encryption) aren't really being exploited seriously. Instead there's lots of halfhearted "oh, let's just encrypt thing X with a password stored in thing Y" where Y is presumably more 'secure'. This is a bit of a tangent, but I find it interesting and depressing that industry has learned very little, if anything.
- tptacek 8y ago
  This article explicitly points out modern alternatives to PGP's clunky, 1990s implementation of asymmetric encryption. But, tangentially, it's a bad idea to use asymmetric encryption when you don't absolutely need it. Modern symmetric AEAD ciphers, which are implicated in pretty much all serious public-key designs anyways, are safer to use that asymmetric cryptography. Seeing a public key in a design that doesn't demand public keys is a cryptographic engineering code smell.
tyingq 8y ago
I believe "gpg -c" remains a better idea than encrypted zip files and "openssl enc" due to better defaults/ciphers/kdf. The article mentions magic wormhole, but sometimes you need plain old symmetric file encryption with a password.
- tptacek 8y ago
  Yes, PGP is better than the Bass-o-matic ZIP cipher many implementations of ZIP use. PGP clears that very, very low bar.
  - tyingq 8y ago
    I did mention "openssl enc" as well. Is there some other common bundled utility I missed? Or it's not useful to compare what's at hand? Not sure I'm getting the message behind the jab.
    - tptacek 8y ago
      "openssl enc" requires you to select from over 105 different cipher constructions, virtually all of which are terribly insecure.
      - deleted 8y ago
        [deleted]
      - tyingq 8y ago
        Okay, so "gpg -c" is better than other commonly installed command line tools for encrypting a file with password?
        tptacek 8y ago
        PGP, which is something you have to explicitly install, is a badly flawed way to encrypt files; it has a poor password KDF and you should look at how it authenticates data. Install something better.
_wldu 8y ago
tptacek - What would you consider a good modern way to replace encrypting large text files to multiple PGP keys? That's my main automated use case for OpenPGP in Go. If there is a simpler, more modern way, I'd like to try it... thanks. Edit: We do this, then push the files to a S3 bucket and users can get the files and decrypt them without having to deal with remembering/forgetting static passwords.
- deleted 8y ago
  [deleted]
- sa2ajj 8y ago
  sorry, I misremembered the tool. there's one that serves your purpose, however I do not remember the name at this time.
- w8rbt 8y ago
  Replying to myself... I think I could actually use nacl/box to accomplish this. I'd just have to take care and break the large files into smaller chunks and find a way for users to easily generate and manage keys. OpenPGP sort of makes key mgt easy.
mikegerwitz 8y ago
PGP is still widely deployed, whether you like it or not. "I don't like it" isn't a valid argument for considering something "legacy", when it works just fine for certain cases.
- tptacek 8y ago
  "I don't like it" isn't my argument for OpenPGP being legacy, and there's nothing in this thread to suggest otherwise.