9 ms·

Towards Sequoia OpenPGP v1.0

83 points by nwalfield 6y ago

pgt 6y ago
Note that this project is unrelated to Sequoia Capital.
- cpach 6y ago
  I guess it's a reference to Sequoyah https://en.wikipedia.org/wiki/Sequoyah https://en.wikipedia.org/wiki/Sequoyah
- DyslexicAtheist 6y ago
  note that Sequoia Capital is totally unrelated to the Indian silversmith and inventor of the Cherokee syllabary
cpach 6y ago
IMO, encrypted e-mail is a dead end. Latacora has a good blog post about it that I highly recommend: https://latacora.micro.blog/2020/02/19/stop-using-encrypted.html https://latacora.micro.blog/2020/02/19/stop-using-encrypted....
- gwd 6y ago
  That post should really be called, "Stop using email". Which is fine when you don't need something like email. But sometimes you do.
  - qqii 6y ago
    Although I agree with your point, both the article and your comment suffer from different use cases + threat models. I'd agree that there are no real alternatives to (regular) mail and email where longer form asynchronous communication can occur without the expectation of an instant reply. Unfortunately when it comes to this form of communication the reality is that there aren't any widely used alternatives that don't leak as much metadata as email.
- dr_hooo 6y ago
  Hmm, I don't really see any really convincing points, or workable alternatives that your linked article provides. Nevertheless I would like to read more about this claim: > It [PGP] was designed in the 1990s, and in the 20 years since it became popular, cryptography has advanced in ways that PGP has not kept up with. So, for example, it recently turned out to be possible for eavesdroppers to decrypt messages without a key, simply by tampering with encrypted messages. Most technologists who work with PGP don’t understand it at a low enough level to see what’s wrong with it. (I admit I am one of these technologists)
  - dependenttypes 6y ago
    It is talking about things like efail.
  - upofadown 6y ago
    My best guess is that they really meant EFAIL but didn't want to actually mention it because EFAIL had nothing to do with any weakness in the OpenPGP standard or the GnuPG implementation. Instead it was a HTML email horror story where someone figured out how to forward entire decrypted messages using image links. So just more pointless anti-PGP innuendo...
    - tptacek 6y ago
      That is not in fact a good description of EFail, which was indeed caused by a failure both of the PGP protocol and of GPG, its reference implementation.
      - upofadown 6y ago
        >...a failure both of the PGP protocol ... No. There were some changes in the actual protocol document that came out of EFAIL but no actual changes to the protocol other than a depreciation that was happening anyway. >...and of GPG, ... This also seems to be false. GPG didn't have to change anything as the result of EFAIL... >...its reference implementation. Also false. OpenPGP does not have a reference implementation.
- steerablesafe 6y ago
  Whenever someone criticizes email encryption they fail to provide an actual replacement. Encrypted instant messaging is an alternative, but it's not a replacement.
  - m-p-3 6y ago
    And yet encrypted instant messaging would have the same pitfalls if the platforms where federated like email is. It only works well and seamlessly because it works within a single provider.
    - upofadown 6y ago
      What about OMEMO?
- laumars 6y ago
  PGP is used for more than just email
  - qqii 6y ago
    The writer of the article wrote another one that is linked where he criticises other uses of PGP[0]. [0]: https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
    - jeltz 6y ago
      Some of those issues are just properties of GPG and could be fixed by an alternative implementation, while others look inherent to the standard.
  - m-p-3 6y ago
    Agreed, can be used for signing git and other stuff. PGP isn't only about encryption, it's also about authentication and integrity.
- tptacek 6y ago
  I wrote an actual piece about PGP: https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html I stand by what I wrote in this post as well, but it's not a good first read for people surprised that cryptographers hate PGP.
  - cpach 6y ago
    Perhaps I should have linked to both essays. People should read them both :) The reason I linked to the other one was that encrypted mails is the first use case listed on the Sequoia site.
qqii 6y ago
Having an alternative implementation to GnuPG is a pretty important. Although many would argue against the use of PGP encryption for many use cases such as email, there are other use cases where PGP's ideas have no replacement. For a specific example take signing git commits. Even fossil scm delegates this task to pgp. Personally keybase is the only project that may provide some form of alternative, but they do so by supporting pgp. I definitely agree that PGP was and is no longer the correct tool for every use case as it sort out to be, but I find there are still pockets where PGP has no alternative. I'd be interested what HN's thoughts are on PGP for this specific use case and if there could be an alternative.
- Leace 6y ago
  > Personally keybase is the only project that may provide some form of alternative, but they do so by supporting pgp. Why keybase? Reading their crypto page (https://keybase.io/blog/crypto https://keybase.io/blog/crypto) leaves the impression that they took PGP and embrace-extend-extinguished it...
  - qqii 6y ago
    I'm not endorsing keybase, in fact I have much of the same criticisms as you probably do. The fact is unlike many PGP replacements most don't attempt to solve similar ideas as the "web of trust". For those that I know do, the cryptocurrency/tokens one's don't even consider backwards compatability. As far as I know keybase are the only ones that embrace PGP and are therefore backwards compatible with git, fossil, etc's commit signing. It may be ignorance but I don't see linux, git or any other software project that "needs" both version control and verifiable commits moving from PGP signing to something else, but rather PGP signing dying out with the rise of git platforms like github, gitlab, etc. If you squint you can see that keybase provides some form of alternative.
    - Leace 6y ago
      To be honest even PGP signing has some issues: it's not clear what does it mean to sign a commit and there is plenty of misuse of that (see [0], `git push --signed` solves some of these issues). Git patch workflow doesn't support signed commits and some kernel devs explore alternative ways of signing [1]. [0]: https://mikegerwitz.com/2012/05/a-git-horror-story-repository-integrity-with-signed-commits https://mikegerwitz.com/2012/05/a-git-horror-story-repositor... [1]: https://people.kernel.org/monsieuricon/introducing-b4-and-patch-attestation https://people.kernel.org/monsieuricon/introducing-b4-and-pa... By "keybase providing alternative" do you mean that they have hosted, encrypted git repos?
mratsim 6y ago
What's the threat model? I've looked into the code. It uses Nettle's Curve25519 which seems to be implemented constant-time (assuming ECC mul is using "ecc-mul-g" from which is protected against cache timing attacks because the other ecc-mul implementations are using raw table access.)
longtermd 6y ago
Off topic af: what does the picture on their landing page symbolize? https://sequoia-pgp.org/ https://sequoia-pgp.org/
- qqii 6y ago
  https://wellcomecollection.org/works/s8yb9bt9 https://wellcomecollection.org/works/s8yb9bt9
superdug 6y ago
I still use PGP to encrypt files with secrets in them that I am sending to a known source, and I know it's still the base encryption for a few well known file servers. A new player in the market is welcomed.
- deleted 6y ago
  [deleted]
- nickray 6y ago
  Keybase's "Crypto tools" tab can do this, with "known destination" determined via social proof. https://keys.pub https://keys.pub is a re-implementation of this use case without the messenger/cryptocurrency baggage that some dislike about Keybase.
jolmg 6y ago
Here's the command line documentation: https://docs.sequoia-pgp.org/sq/index.html https://docs.sequoia-pgp.org/sq/index.html I have to admit that it looks more digestible than gpg's. It seems it's still missing a way to manage OpenPGP smartcards like Yubikeys. Also, I can't see a way to manage an arbitrary set of subkeys for a given primary key. I'm really happy to see an alternative to GnuPG, though. This looks promising.
saurik 6y ago
As someone who has been trying to use this library but haven't had the time to finish build integration to cross compile for all of my target platforms, I really wish it weren't using nettle, particularly as it is also using openssl :(. Does rust not have useful cryptography libraries yet? Or couldn't it just openssl?

83 points by nwalfield 6y ago

pgt 6y ago

Note that this project is unrelated to Sequoia Capital.

cpach 6y ago
I guess it's a reference to Sequoyah https://en.wikipedia.org/wiki/Sequoyah https://en.wikipedia.org/wiki/Sequoyah
DyslexicAtheist 6y ago
note that Sequoia Capital is totally unrelated to the Indian silversmith and inventor of the Cherokee syllabary

cpach 6y ago

IMO, encrypted e-mail is a dead end. Latacora has a good blog post about it that I highly recommend: https://latacora.micro.blog/2020/02/19/stop-using-encrypted.html https://latacora.micro.blog/2020/02/19/stop-using-encrypted....

gwd 6y ago
That post should really be called, "Stop using email". Which is fine when you don't need something like email. But sometimes you do.
- qqii 6y ago
  Although I agree with your point, both the article and your comment suffer from different use cases + threat models. I'd agree that there are no real alternatives to (regular) mail and email where longer form asynchronous communication can occur without the expectation of an instant reply. Unfortunately when it comes to this form of communication the reality is that there aren't any widely used alternatives that don't leak as much metadata as email.
dr_hooo 6y ago
Hmm, I don't really see any really convincing points, or workable alternatives that your linked article provides. Nevertheless I would like to read more about this claim: > It [PGP] was designed in the 1990s, and in the 20 years since it became popular, cryptography has advanced in ways that PGP has not kept up with. So, for example, it recently turned out to be possible for eavesdroppers to decrypt messages without a key, simply by tampering with encrypted messages. Most technologists who work with PGP don’t understand it at a low enough level to see what’s wrong with it. (I admit I am one of these technologists)
- dependenttypes 6y ago
  It is talking about things like efail.
- upofadown 6y ago
  My best guess is that they really meant EFAIL but didn't want to actually mention it because EFAIL had nothing to do with any weakness in the OpenPGP standard or the GnuPG implementation. Instead it was a HTML email horror story where someone figured out how to forward entire decrypted messages using image links. So just more pointless anti-PGP innuendo...
  - tptacek 6y ago
    That is not in fact a good description of EFail, which was indeed caused by a failure both of the PGP protocol and of GPG, its reference implementation.
    - upofadown 6y ago
      >...a failure both of the PGP protocol ... No. There were some changes in the actual protocol document that came out of EFAIL but no actual changes to the protocol other than a depreciation that was happening anyway. >...and of GPG, ... This also seems to be false. GPG didn't have to change anything as the result of EFAIL... >...its reference implementation. Also false. OpenPGP does not have a reference implementation.
steerablesafe 6y ago
Whenever someone criticizes email encryption they fail to provide an actual replacement. Encrypted instant messaging is an alternative, but it's not a replacement.
- m-p-3 6y ago
  And yet encrypted instant messaging would have the same pitfalls if the platforms where federated like email is. It only works well and seamlessly because it works within a single provider.
  - upofadown 6y ago
    What about OMEMO?
laumars 6y ago
PGP is used for more than just email
- qqii 6y ago
  The writer of the article wrote another one that is linked where he criticises other uses of PGP[0]. [0]: https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
  - jeltz 6y ago
    Some of those issues are just properties of GPG and could be fixed by an alternative implementation, while others look inherent to the standard.
- m-p-3 6y ago
  Agreed, can be used for signing git and other stuff. PGP isn't only about encryption, it's also about authentication and integrity.
tptacek 6y ago
I wrote an actual piece about PGP: https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html I stand by what I wrote in this post as well, but it's not a good first read for people surprised that cryptographers hate PGP.
- cpach 6y ago
  Perhaps I should have linked to both essays. People should read them both :) The reason I linked to the other one was that encrypted mails is the first use case listed on the Sequoia site.

qqii 6y ago

Having an alternative implementation to GnuPG is a pretty important. Although many would argue against the use of PGP encryption for many use cases such as email, there are other use cases where PGP's ideas have no replacement. For a specific example take signing git commits. Even fossil scm delegates this task to pgp. Personally keybase is the only project that may provide some form of alternative, but they do so by supporting pgp. I definitely agree that PGP was and is no longer the correct tool for every use case as it sort out to be, but I find there are still pockets where PGP has no alternative. I'd be interested what HN's thoughts are on PGP for this specific use case and if there could be an alternative.

Leace 6y ago
> Personally keybase is the only project that may provide some form of alternative, but they do so by supporting pgp. Why keybase? Reading their crypto page (https://keybase.io/blog/crypto https://keybase.io/blog/crypto) leaves the impression that they took PGP and embrace-extend-extinguished it...
- qqii 6y ago
  I'm not endorsing keybase, in fact I have much of the same criticisms as you probably do. The fact is unlike many PGP replacements most don't attempt to solve similar ideas as the "web of trust". For those that I know do, the cryptocurrency/tokens one's don't even consider backwards compatability. As far as I know keybase are the only ones that embrace PGP and are therefore backwards compatible with git, fossil, etc's commit signing. It may be ignorance but I don't see linux, git or any other software project that "needs" both version control and verifiable commits moving from PGP signing to something else, but rather PGP signing dying out with the rise of git platforms like github, gitlab, etc. If you squint you can see that keybase provides some form of alternative.
  - Leace 6y ago
    To be honest even PGP signing has some issues: it's not clear what does it mean to sign a commit and there is plenty of misuse of that (see [0], `git push --signed` solves some of these issues). Git patch workflow doesn't support signed commits and some kernel devs explore alternative ways of signing [1]. [0]: https://mikegerwitz.com/2012/05/a-git-horror-story-repository-integrity-with-signed-commits https://mikegerwitz.com/2012/05/a-git-horror-story-repositor... [1]: https://people.kernel.org/monsieuricon/introducing-b4-and-patch-attestation https://people.kernel.org/monsieuricon/introducing-b4-and-pa... By "keybase providing alternative" do you mean that they have hosted, encrypted git repos?

mratsim 6y ago

What's the threat model? I've looked into the code. It uses Nettle's Curve25519 which seems to be implemented constant-time (assuming ECC mul is using "ecc-mul-g" from which is protected against cache timing attacks because the other ecc-mul implementations are using raw table access.)

longtermd 6y ago

Off topic af: what does the picture on their landing page symbolize? https://sequoia-pgp.org/ https://sequoia-pgp.org/

qqii 6y ago
https://wellcomecollection.org/works/s8yb9bt9 https://wellcomecollection.org/works/s8yb9bt9

superdug 6y ago

I still use PGP to encrypt files with secrets in them that I am sending to a known source, and I know it's still the base encryption for a few well known file servers. A new player in the market is welcomed.

deleted 6y ago
[deleted]
nickray 6y ago
Keybase's "Crypto tools" tab can do this, with "known destination" determined via social proof. https://keys.pub https://keys.pub is a re-implementation of this use case without the messenger/cryptocurrency baggage that some dislike about Keybase.

jolmg 6y ago

Here's the command line documentation: https://docs.sequoia-pgp.org/sq/index.html https://docs.sequoia-pgp.org/sq/index.html I have to admit that it looks more digestible than gpg's. It seems it's still missing a way to manage OpenPGP smartcards like Yubikeys. Also, I can't see a way to manage an arbitrary set of subkeys for a given primary key. I'm really happy to see an alternative to GnuPG, though. This looks promising.

saurik 6y ago

As someone who has been trying to use this library but haven't had the time to finish build integration to cross compile for all of my target platforms, I really wish it weren't using nettle, particularly as it is also using openssl :(. Does rust not have useful cryptography libraries yet? Or couldn't it just openssl?