3 ms·

Sadly age is only tackling one of the easier parts of gnupg, encrypting files. Implying age replaces gnupg is overselling it. We don't have any good alternativ

Sadly age is only tackling one of the easier parts of gnupg, encrypting files. Implying age replaces gnupg is overselling it. We don't have any good alternatives for a web-of-trust (or something akin) where we can sign files or attest trust to some identity. Signify does parts of this, but lacks the trust aspects which makes you establish convoluted key distribution schemes to ensure you have future signing keys lined up. There isn't any good replacements for F/OSS developers that needs to have some from of signatures between them. Say replace linux distributions usage of signatures to form some network of developer trust.

SAI_Peregrinus 6y ago
PGP keyservers don't support the web of trust any more either.
- pabs3 6y ago
  There are some ideas for restoring support for the web of trust, not sure if they got implemented yet though: https://tools.ietf.org/html/draft-dkg-openpgp-abuse-resistant-keystore-03#section-10 https://tools.ietf.org/html/draft-dkg-openpgp-abuse-resistan... https://gitlab.com/dkg/draft-openpgp-abuse-resistant-keystore/ https://gitlab.com/dkg/draft-openpgp-abuse-resistant-keystor... https://lwn.net/Articles/792674/ https://lwn.net/Articles/792674/
- Foxboron 6y ago
  Which is why most distributions and other projects has moved to WKDs for key discovery. I don't think this is a good argument though as there are alternatives, even though they don't work super well at the moment.
  - Leace 6y ago
    > Which is why most distributions and other projects has moved to WKDs for key discovery. Yeah, WKD is a first-class citizen in GnuPG. Creating signatures with "--sender $EMAIL" embeds e-mail in the signature and then gpg --auto-key-retrieve --verify will fetch the key via WKD without the need to touch keyservers.
garmaine 6y ago
Modern cryptographic tools are very purposefully “one tool, one use.” That’s part of the design and security model.
- Foxboron 6y ago
  Which makes the problem harder to solve. But this isn't an argument against the functionality though? It's still something we need if the community wants to move away from GnuPG. What are the alternatives? PKCS7? I don't see that being less complicated then gnupg when it comes to usage. I think Void Linux is using this though, however you are still stuck without a proper way to assign trust.

SAI_Peregrinus 6y ago

PGP keyservers don't support the web of trust any more either.

pabs3 6y ago
There are some ideas for restoring support for the web of trust, not sure if they got implemented yet though: https://tools.ietf.org/html/draft-dkg-openpgp-abuse-resistant-keystore-03#section-10 https://tools.ietf.org/html/draft-dkg-openpgp-abuse-resistan... https://gitlab.com/dkg/draft-openpgp-abuse-resistant-keystore/ https://gitlab.com/dkg/draft-openpgp-abuse-resistant-keystor... https://lwn.net/Articles/792674/ https://lwn.net/Articles/792674/
Foxboron 6y ago
Which is why most distributions and other projects has moved to WKDs for key discovery. I don't think this is a good argument though as there are alternatives, even though they don't work super well at the moment.
- Leace 6y ago
  > Which is why most distributions and other projects has moved to WKDs for key discovery. Yeah, WKD is a first-class citizen in GnuPG. Creating signatures with "--sender $EMAIL" embeds e-mail in the signature and then gpg --auto-key-retrieve --verify will fetch the key via WKD without the need to touch keyservers.

garmaine 6y ago

Modern cryptographic tools are very purposefully “one tool, one use.” That’s part of the design and security model.

Foxboron 6y ago
Which makes the problem harder to solve. But this isn't an argument against the functionality though? It's still something we need if the community wants to move away from GnuPG. What are the alternatives? PKCS7? I don't see that being less complicated then gnupg when it comes to usage. I think Void Linux is using this though, however you are still stuck without a proper way to assign trust.