3 ms·

>A particular favorite part for me is when they point out that their local PGP installation doesn't include CAST5 --- but does include 3DES, the canonical insec

>A particular favorite part for me is when they point out that their local PGP installation doesn't include CAST5 --- but does include 3DES, the canonical insecure 64-bit-block cipher. All OpenPGP installations require 3DES as the ultimate fallback. It is hard coded into the standard (RFC-4880). This comment seems to come from a fundamental misunderstanding of how OpenPGP works. The cryptographic preferences are signed by the certification key along with everything else in the OpenPGP identity (AKA public key). There is no possibility of any sort of downgrade attack. You would need to break the signature. This is one of the ways that offline encryption like OpenPGP is superior to online encryption like TLS. So there is no downside to supporting old algorithms. Not that 3DES is inherently broken anyway if you are willing to keep your messages below a GB or so.

tptacek 5y ago
It is hard coded into the standard (RFC-4880). I rest my case. Except to say, I just think it's funny that the defense to "PGP relies in part on CAST5" was to say "no, it relies on a somewhat less secure cipher". We tolerate design details like this in PGP because we're LARPing, and care more about the software community of PGP enthusiasts than we care sincerely about at-risk people who might make the mistake of trusting it. I'm sure it would be hard to modernize PGP and force everyone onto modern AEADs and key agreement schemes and packet formats. I also think that demanding everyone's phone numbers made life a lot harder for Signal than it could have been. But Signal cared more about security than about nerd adoption, and PGP makes the opposite trade.
- upofadown 5y ago
  >We tolerate design details like this in PGP because we're LARPing, ... Please, if you can't address the point then do not turn to personal attacks... We are here to discuss, not pointlessly argue...
  - tptacek 5y ago
    It's not a personal attack. It has in fact nothing to do with you at all. See the post upthread.

tptacek 5y ago

It is hard coded into the standard (RFC-4880). I rest my case. Except to say, I just think it's funny that the defense to "PGP relies in part on CAST5" was to say "no, it relies on a somewhat less secure cipher". We tolerate design details like this in PGP because we're LARPing, and care more about the software community of PGP enthusiasts than we care sincerely about at-risk people who might make the mistake of trusting it. I'm sure it would be hard to modernize PGP and force everyone onto modern AEADs and key agreement schemes and packet formats. I also think that demanding everyone's phone numbers made life a lot harder for Signal than it could have been. But Signal cared more about security than about nerd adoption, and PGP makes the opposite trade.

upofadown 5y ago
>We tolerate design details like this in PGP because we're LARPing, ... Please, if you can't address the point then do not turn to personal attacks... We are here to discuss, not pointlessly argue...
- tptacek 5y ago
  It's not a personal attack. It has in fact nothing to do with you at all. See the post upthread.