5 ms·

Any good alternatives?

• Avamander 7y ago
  Standard S/MIME for e-mail, minisign for signing software, standard ASICE for encrypted containers
  • tptacek 7y ago
    S/MIME is even worse than PGP.
    • Avamander 7y ago
      S/MIME has better e-mail client support and has massive deployment (use, not that much) in Estonia. I think it already beats PGP in two major aspects with that.
      • tptacek 7y ago
        S/MIME manages the feat of being even less secure than PGP-encrypted email, which was, again, a low bar to trip over.
        • Avamander 7y ago
          Please elaborate.
          • wolf550e 7y ago
            I think efail showed S/MIME was even more susceptible.
            • Avamander 7y ago
              That vulnerability has been largely mitigated, hasn't it? I'm really curious how GPG is more secure than S/MIME right now.
              • wolf550e 7y ago
                "8.2 Countering malleability gadget attacks" in the efail paper says: "The S/MIME standard does not provide any effective security measures countering our attacks" and "Although CMS defines an AuthenticatedData type [29], S/MIME’s current specification does not." If the S/MIME spec does not enforce (and it seems it doesn't even allow, not just does't enforce) Authenticated Encryption, then it violates "the cryptographic doom principle" and should not be used for anything except CTFs and cryptopals exercises.
                • Avamander 7y ago
                  The effective measure against their attack is signing and encrypting your e-mail sent with S/MIME? If it's just encrypted then yes, there's malleability issues but if it's signed I don't see it happening.
  • yrro 7y ago
    Never heard of ASCIE, I assume you're referring to https://en.wikipedia.org/wiki/Associated_Signature_Containers#ASiC_Extended_(ASiC-E) https://en.wikipedia.org/wiki/Associated_Signature_Container...
    • Avamander 7y ago
      Indeed. It's an EU standard, http://www.etsi.org/deliver/etsi_en/319100_319199/31916201/01.01.01_60/en_31916201v010101p.pdf http://www.etsi.org/deliver/etsi_en/319100_319199/31916201/0...
• rwbhn 7y ago
  https://news.ycombinator.com/item?id=19173326 https://news.ycombinator.com/item?id=19173326
• ahazred8ta 7y ago
  "Things that use Ed25519" https://ianix.com/pub/ed25519-deployment.html#ed25519-software https://ianix.com/pub/ed25519-deployment.html#ed25519-softwa... is a grab-bag of nacl-style modern alternatives (of varying quality)