6 ms·

PGP is an unfortunate obsolete technology, which sadly failed to evolve with the times. I think the main thing that crippled PGP is tooling. What we have avail

PGP is an unfortunate obsolete technology, which sadly failed to evolve with the times. I think the main thing that crippled PGP is tooling. What we have available is GnuPG, and GnuPG is horrible for every use case but what it was made for: A command-line interactive application, made for a single person's personal usage. GnuPG insists on a model where it manages everything: key parsing, a key database, and the entire signing/verification process. There's no proper libgnupg either, what gpgme does is calling gpg, and presenting a library interface. The problem with this is that GnuPG is very unfriendly towards attempts to build something new from the pieces. It really wants to be a commandline application that deals with a single person's encryption/decryption activities. So if you want to say, run statistics on PGP keys, or write a keyserver, or use it to implement signatures for packages, either you do it the GnuPG way, or you very laboriously trick it into doing what you need, or you write your own crypto code. Option 1 isn't great if you want anything weird like statistics gathering. Option 2 is just awkward and messy. Both 1 and 2 quickly run into limits. GPG for instance doesn't like trying to work with a database of a million keys. It has heavy startup costs. It's made for humans, not for any kind of heavy lifting. Option 3 sucks because OpenPGP is extremely complex, and writing crypto code is very ill advised for most people. And I think that's kinda what crippled the ecosystem. Doing anything but what gnupg wants to do has extreme startup costs, so few people ever try, and most people do it badly. Doing what the author did here involves really going out of your way -- in a better world we'd have simple to use tooling to do this work, and PyPI would just do validation and reject bad stuff, but doing so is extremely non-trivial in PGP. *Edit:* Case in point, I wondered how the author did this analysis. They made a tool for it, in April 2023: https://blog.yossarian.net/2023/04/14/Introducing-pgpkeydump https://blog.yossarian.net/2023/04/14/Introducing-pgpkeydump This is a tool that GPG should have had decades ago, and yet it didn't exist until now, when pretty much everyone has given up on PGP signing. Edit 2: A nice blog post on how painful it is to deal with gpg if you want to actually build on top of it: https://www.mailpile.is/blog/2014-10-07_Some_Thoughts_on_GnuPG.html https://www.mailpile.is/blog/2014-10-07_Some_Thoughts_on_Gnu...

WesolyKubeczek 3y ago
Isn't there that new thing called Sequoia which is supposed to have all advantages of PGP while having none of its drawbacks?
- dale_glass 3y ago
  Yup, but it's a new thing. It's something like 2-3 years old, I think? I'm not sure, maybe that'll revive things some? But something of this sort has been needed for decades.
  - WesolyKubeczek 3y ago
    I'm given to understand that OpenPGP as such is not vile per se; it is a standard on which you can build a secure and flexible system that can evolve as ciphers evolve, etc. It's GnuPG that gave it all bad fame. It's also where I tend to agree with he-who-shouldn't-be-named-on-hn-lest-a-shitfest-begins: "never ever roll your own cryptography" stigmatized the field such that anyone who would like to actually try to do something is first discouraged by their peer crabs in the bucket repeating "never ever roll your own cryptography" mantra, and those who get past that are discouraged by the old boys' club of Those Doing Cryptography for Decades who seem to imply that you need to have at least a Nobel Prize in Mathematics to join the club — even though those are the same folks who also gave us a plethora of cutely named OpenSSL vulnerabilities and made GnuPG an unscalable cabinet of morbid curiosities (where the curiosities are all those wonderful workarounds that put GUIs on GPG, integrate it with other systems, etc). I wish People Doing Cryptography for Decades had enough humility to admit that they don't know everything, and that maybe while they may be algorithm demigods (although all those sweet named vulnerabilities would make some question that status), there also exist folks who do API and UX design better. If only people could talk to one another...
    - dale_glass 3y ago
      OpenPGP is kind of crap too. It's a devilishly complex format with all sorts of footguns and backwards compatibility going back decades, and badly chosen defaults. Really I think it should be killed too. Right now if you want to talk to everything you'll end up implementing stuff like CAST5, SHA1, compression (seemed like a good idea back in the day, turns out it's not!), and the NSA's backdoored elliptic curve algorithm. This will be a huge undertaking, and a lot of it is frankly crap that shouldn't be used if not actively dangerous. Or you could stick to modern crypto and follow the latest security practices, and save yourself a whole bunch of work. But then why suffer implementing the packet format? You won't be able to interoperate with software that for some reason in 2023 uses SHA1 anyway.
arthur2e5 3y ago
The pgpkeydump page links to... six pages about GPG in the "Much has been written about this" part. GnuPG is one of the cases where "rewrite it in rust" helps a little. rPGP and sequoia-openpgp offer somewhat reasonable library interfaces. pgpkeydump depends on sequoia. With a rewrite you also don't get maintainer issues like https://twitter.com/FiloSottile/status/1355194247482384392 https://twitter.com/FiloSottile/status/1355194247482384392 either.
- chlorion 3y ago
  Thanks for posting that link. I did not realize that the GPG maintainers were so terrible. This strongly reaffirms my choice to move away from GPG where possible!
forgotmypw17 3y ago
It seems like without fail, whenever PGP is mentioned, someone is ready to offer criticism of it, usually without offering a better alternative, since one doesn't really exist. Yet it is the most stable, the most open, the most proven, and the most supported PKI technology, supporting both encryption and signatures. I found GnuPG and OpenPGP.js are incredibly easy to integrate into my project. I didn't like the current ways that it is used, so I designed a new way, with disposable private keys, which frees the user from key management burdens. I don't use many of PGP's features which I don't need, such as key management and nested keys. PGP is still an incredible standard and technology, the rare kind that's remained supported and (mostly) backwards-compatible for 25+ years, like HTML and Perl. I'm glad it exists, and I anticipate it being useful for at least another 25, thanks to the Lindy Effect.
- dale_glass 3y ago
  > It seems like without fail, whenever PGP is mentioned, someone is ready to offer criticism of it, usually without offering a better alternative, since one doesn't really exist.\ And arguably, it shouldn't exist. Modern thinking is that encryption is integral to a project and how it's implemented depends on what the project does. The old way is: Secure mail by passing it through PGP. Secure messages by passing them though PGP. Secure packages by passing them through PGP. The new way is: secure stuff by designing a system specific to what you need. So for instance, encrypting IM gives you the https://en.wikipedia.org/wiki/Signal_Protocol https://en.wikipedia.org/wiki/Signal_Protocol which has a whole bunch of complexity you wouldn't have for signing RPM packages because it needs it, while RPM doesn't.
  - forgotmypw17 3y ago
    PGP is much more than email. It is a general-purpose text and binary encryption system with FOSS libraries and user-facing software for every major platform. It can be used for email, IM, package signing, authentication, and many other uses. And it is time-tested, with 25 years of library-building and 25 years of people trying to break it. Yes, it has many features which most projects don't need, and anyone is free to not use those features. Most documents I write do not include tables, but I would not argue that tables are an unnecessary feature. And same with PGP, I don't use most of its features, but I'm OK with them being there.

WesolyKubeczek 3y ago

Isn't there that new thing called Sequoia which is supposed to have all advantages of PGP while having none of its drawbacks?

dale_glass 3y ago
Yup, but it's a new thing. It's something like 2-3 years old, I think? I'm not sure, maybe that'll revive things some? But something of this sort has been needed for decades.
- WesolyKubeczek 3y ago
  I'm given to understand that OpenPGP as such is not vile per se; it is a standard on which you can build a secure and flexible system that can evolve as ciphers evolve, etc. It's GnuPG that gave it all bad fame. It's also where I tend to agree with he-who-shouldn't-be-named-on-hn-lest-a-shitfest-begins: "never ever roll your own cryptography" stigmatized the field such that anyone who would like to actually try to do something is first discouraged by their peer crabs in the bucket repeating "never ever roll your own cryptography" mantra, and those who get past that are discouraged by the old boys' club of Those Doing Cryptography for Decades who seem to imply that you need to have at least a Nobel Prize in Mathematics to join the club — even though those are the same folks who also gave us a plethora of cutely named OpenSSL vulnerabilities and made GnuPG an unscalable cabinet of morbid curiosities (where the curiosities are all those wonderful workarounds that put GUIs on GPG, integrate it with other systems, etc). I wish People Doing Cryptography for Decades had enough humility to admit that they don't know everything, and that maybe while they may be algorithm demigods (although all those sweet named vulnerabilities would make some question that status), there also exist folks who do API and UX design better. If only people could talk to one another...
  - dale_glass 3y ago
    OpenPGP is kind of crap too. It's a devilishly complex format with all sorts of footguns and backwards compatibility going back decades, and badly chosen defaults. Really I think it should be killed too. Right now if you want to talk to everything you'll end up implementing stuff like CAST5, SHA1, compression (seemed like a good idea back in the day, turns out it's not!), and the NSA's backdoored elliptic curve algorithm. This will be a huge undertaking, and a lot of it is frankly crap that shouldn't be used if not actively dangerous. Or you could stick to modern crypto and follow the latest security practices, and save yourself a whole bunch of work. But then why suffer implementing the packet format? You won't be able to interoperate with software that for some reason in 2023 uses SHA1 anyway.

arthur2e5 3y ago

The pgpkeydump page links to... six pages about GPG in the "Much has been written about this" part. GnuPG is one of the cases where "rewrite it in rust" helps a little. rPGP and sequoia-openpgp offer somewhat reasonable library interfaces. pgpkeydump depends on sequoia. With a rewrite you also don't get maintainer issues like https://twitter.com/FiloSottile/status/1355194247482384392 https://twitter.com/FiloSottile/status/1355194247482384392 either.

chlorion 3y ago
Thanks for posting that link. I did not realize that the GPG maintainers were so terrible. This strongly reaffirms my choice to move away from GPG where possible!

forgotmypw17 3y ago

It seems like without fail, whenever PGP is mentioned, someone is ready to offer criticism of it, usually without offering a better alternative, since one doesn't really exist. Yet it is the most stable, the most open, the most proven, and the most supported PKI technology, supporting both encryption and signatures. I found GnuPG and OpenPGP.js are incredibly easy to integrate into my project. I didn't like the current ways that it is used, so I designed a new way, with disposable private keys, which frees the user from key management burdens. I don't use many of PGP's features which I don't need, such as key management and nested keys. PGP is still an incredible standard and technology, the rare kind that's remained supported and (mostly) backwards-compatible for 25+ years, like HTML and Perl. I'm glad it exists, and I anticipate it being useful for at least another 25, thanks to the Lindy Effect.

dale_glass 3y ago
> It seems like without fail, whenever PGP is mentioned, someone is ready to offer criticism of it, usually without offering a better alternative, since one doesn't really exist.\ And arguably, it shouldn't exist. Modern thinking is that encryption is integral to a project and how it's implemented depends on what the project does. The old way is: Secure mail by passing it through PGP. Secure messages by passing them though PGP. Secure packages by passing them through PGP. The new way is: secure stuff by designing a system specific to what you need. So for instance, encrypting IM gives you the https://en.wikipedia.org/wiki/Signal_Protocol https://en.wikipedia.org/wiki/Signal_Protocol which has a whole bunch of complexity you wouldn't have for signing RPM packages because it needs it, while RPM doesn't.
- forgotmypw17 3y ago
  PGP is much more than email. It is a general-purpose text and binary encryption system with FOSS libraries and user-facing software for every major platform. It can be used for email, IM, package signing, authentication, and many other uses. And it is time-tested, with 25 years of library-building and 25 years of people trying to break it. Yes, it has many features which most projects don't need, and anyone is free to not use those features. Most documents I write do not include tables, but I would not argue that tables are an unnecessary feature. And same with PGP, I don't use most of its features, but I'm OK with them being there.