6 ms·
What do you recommend as a replacement for PGP? (I'm looking for stand-alone software I can use to encrypt files on storage media, not an encrypted e-mail servi
by greenyoda 5y ago
What do you recommend as a replacement for PGP? (I'm looking for stand-alone software I can use to encrypt files on storage media, not an encrypted e-mail service.)
- tptacek 5y agoThe high bit of the right answer to this question is that you don't want to replace PGP; one of the things we've learned in 29 years is that you don't want a single tool to do lots of different cryptographic things, because different applications have different cryptographic needs. For package signing: use something in the signify/minisign family. To encrypt a network transport, use WireGuard. To protect a web transaction on the wire, TLS 1.3. For transferring files: use Magic Wormhole. For backups: use something like Tarsnap or restic. For messaging: use something that does Signal Protocol. To protect files at rest, use encrypted DMGs (or your OS's equivalent, like encrypted loop mounts). To encrypt individual files --- a niche ask --- use Filippo's ungooglable "age".
- greenyoda 5y agoThanks! Link to "age", for those who are interested: https://github.com/FiloSottile/age https://github.com/FiloSottile/age
- upofadown 5y agoLast I looked "age" did not have any sort of recovery utility. It isn't even clear that such a utility is possible (the protocol is poorly documented). A single bit error at the start of the file causes the loss of the entire file. So be careful using it for any sort of thing that might ever require the sort of recovery that bzip2 or lzip provides (gzip has a third party recovery utility). OpenPGP has excellent recovery properties out of the box BTW...
- tptacek 5y agoI want to be sure I'm reading this correctly. Failing to decrypt on a single bit error is the literal job definition of authenticated encryption. Any error you accept is malleability conceded to an attacker. Are you complaining that age isn't malleable enough?
- upofadown 5y ago>Failing to decrypt on a single bit error is the literal job definition of authenticated encryption. Yes, this is an excellent example of where this behaviour is suboptimal. We should not cargo cult authenticated encryption. It has its place but this isn't it. > Any error you accept is malleability conceded to an attacker. Sure, but malleability that has a close to zero chance of being a problem. We are talking about static encryption here. You only get one chance at malleability and the user immediately knows something has gone wrong: gpg: WARNING: encrypted message has been manipulated! >Are you complaining that age isn't malleable enough? Merely pointing out that for the most common use case age is objectively worse than GPG.
- tptacek 5y agoI think you are doing a fine job of advocating the position that PGP is the cryptosystem of choice for people who believe authenticated encryption is a cargo cult. The logic you're applying here about how GPG can warn you if it has employed "recovery properties" to correct "single bit errors" was embraced enthusiastically by the Ruhr team to perform data recovery on other people's PGP-encrypted email messages.
- some_furry 5y ago> Sure, but malleability that has a close to zero chance of being a problem. https://efail.de https://efail.de https://tonyarcieri.com/all-the-crypto-code-youve-ever-written-is-probably-broken https://tonyarcieri.com/all-the-crypto-code-youve-ever-writt... This isn't even a controversy among cryptographers or cryptography engineers.
- upofadown 5y ago
- atoponce 5y agoWhat exactly is an OpenPGP recovery property? Can you point it out in the RFC?
- upofadown 5y agoOpenPGP specifies cipher feed back (CFB) mode[1] for block ciphers (normally AES). CFB has the inherent property that it is self healing in the face of corruption. It does not work in all possible instances of corruption but it works for the normal sort of corruption that is seen with mass storage devices (multiples of 512 bytes). A practical example here[2]. [1] https://datatracker.ietf.org/doc/html/rfc4880#section-13.9 https://datatracker.ietf.org/doc/html/rfc4880#section-13.9 [2] https://articles.59.ca/doku.php?id=pgpfan:agevspgp#encrypted_backups https://articles.59.ca/doku.php?id=pgpfan:agevspgp#encrypted...
- atoponce 5y agoI see. You're defining resynchronization of the register during decryption as recovery, not parity checks for recovering corrupted data. Fair enough.
- stormbrew 5y agoIt would be nice if there was a reasonable baseline of key format/management that all these new tools shared though. And I don't mean pgp/gpg keyrings, to be clear, which are cumbersome and error prone and over-complicated for a lot of these needs (I'm still annoyed that `pass` is reliant on gpg for forcing me to deal with a keyring). I see that `age`, which I hadn't actually heard of before, supports ssh keys and identities which always seemed like a fairly natural baseline to me. Would be nice if more of the command line variety did as well (even if only rsa and/or ed25519 keys).
- tptacek 5y agoWhy? Why is that good? One of the basic cardinal sins of cryptography is using the same key in more than one context. I don't understand the value of the SSH thing, either.
- neolog 5y agoWhat is a "context"? I don't want to manage a ton of key files on my desktop computer.
- stormbrew 5y agoI don't want to use the same key in multiple contexts, but I think some norms around how keys are stored would help build best practices around them. It would also potentially mean easier to use with hardware tokens, if you could just expect to be able to use something like gpg-agent or ssh-agent or something in between to work with various things.
- tptacek 5y agoFair enough, that's a good answer. Thanks!
- Avamander 5y agoHardware cryptographic storage comes to mind, or simply key management and storage is complex with multiple keys in a lot of different forms.
- shawnz 5y agoWhich of these do I use to send encrypted messages to darknet vendors based on well-known public keys shared through Reddit etc? This is the number one use case of PGP for me and it doesn't seem to be solved by any of these other tools.
- GekkePrutser 5y agoThe big problem with those DMGs is that they only work on one OS. This is one thing where PGP encrypted files shine.
- tzs 5y agoI find "age" a bit awkward when it comes to handling private keys. I want to store my private key files encrypted. If it just would accept private key files that have been encrypted with a passphrase it would be almost perfect. There are ways to work around this [1], but I'm not happy with any of them. [1] https://news.ycombinator.com/item?id=24378350 https://news.ycombinator.com/item?id=24378350
- FiloSottile 5y agoGood news, everyone! https://github.com/FiloSottile/age/commit/d164fef036a2d19280d9de67607e41e1f36ca578 https://github.com/FiloSottile/age/commit/d164fef036a2d19280... It will be in the next release candidate.
- ahelwer 5y agoHow do you feel about 7zip's AES encryption functionality for files or sets of files?
- tptacek 5y agoIt is maddeningly difficult to simply encrypt a file with interoperable tools. I'm optimistic about age, but it's early days. I understand why people want to use 7z for this. The problem is, if anyone else tries to send you an encrypted zip, and they use something other than 7z, they will likely end up using something even worse than Bass-O-Matic; the zip encryption ecosystem is unbelievably horrible, and it's intractably difficult for ordinary people to know what they're getting. So: long story short, I would tell a client "never, ever use encrypted zips".
- intc 5y agoI think PGP is fine for encrypting some files. But you should take into consideration that when you encrypt a file it's very likely that some (or all) of the plain text is left behind on the block device. Using full disk encryption (LUKS for example) will give additional protection (so one can't read plain text fragments from the device when it's not "open").
- makach 5y agoI don’t understand why people want to replace PGP. Of course we can improve the technology but the fact is that security is hard and requires interplay between the humans, processes and technology to work. It’s not enough to rely on just one of those pillars. There is an illusion in the world of IT that we can solve everything with technology. Maybe the reason why people don’t want or like PGP is because it needs strong human processes to work properly and keep its integrity, and that breaks the illusion that you can easily solve everything with tech. Happy birthday PGP!
- tptacek 5y agoIt's funny that you could make literally the same argument about C, especially since so much of the PGP ecosystem relies directly and entirely on software built in C.
- tialaramex 5y ago> Maybe the reason why people don’t want or like PGP is because it needs strong human processes to work properly and keep its integrity, and that breaks the illusion that you can easily solve everything with tech. What you've got here is pretty much the mirror of the argument you've dismissed a paragraph earlier. Now you're desperate to rely on humans instead. This makes me think about Snowpiercer, for two reasons. One is that Snowpiercer has this ludicrous conceit about replacing unavailable engine components with humans but the other is that we've really been here with the actual railway trains in the nineteenth century. There was a pattern. One of these new-fangled railway trains crashes, often killing many people, the company directs public blame toward the driver, who will be portrayed as incompetent, drunk or worse and so fully responsible for the accident. Nothing changes, rinse, repeat. How was this cycle broken? We did not find some species of super-human train driver, instead we invented technology such as the Absolute Block system, Interlocking railway signals, the Dead Man's Handle. Even apparently trivial technologies like the Driver's Reminder Appliance (it's just a switch!) are still technology. PGP isn't very good technology. Like one of those early mechanical signals that might seem to indicate "clear" but it's actually just weighed down by snow and frozen in place so that it can't indicate "danger" instead, the way forward isn't "We need to rely on super-humans to compensate for the short-comings of the technology" but "We need a technology that sucks less so the humans don't need to be super-human to succeed".
- darkr 5y agoThe other points in this thread recommending modern, context-specific cryptography tools are very valid, however if you're set on PGP; Sequoia[1] is a new(ish) OpenPGP library written from the ground up in Rust. 1: https://sequoia-pgp.org/ https://sequoia-pgp.org/
- tptacek 5y agoSequoia is fine work, and running less C code is a good thing, so if you have to use PGP (sorry) then use Sequoia. But note that the PGP ecosystem is hopelessly mired in GPG, and the problems go beyond C code --- Sequoia, for instance, is (AFAIK) the first popular implementation of AEAD crypto for GPG, but AEAD doesn't interoperate with GPG.