4 ms·

In Russia you can get a key-certificate pair (x509, perhaps with GOST algorithms) signed by government CA and then sign documents with it. How different this O

In Russia you can get a key-certificate pair (x509, perhaps with GOST algorithms) signed by government CA and then sign documents with it. How different this OpenPGP key stuff is, minus the "OpenPGP is so bad we decided to sunset it" vibe?

varjag 3y ago
The jab at OpenPGP feels unnecessary when your yardstick is an FSB signature using a GOST.
- thriftwy 3y ago
  The problem with OpenPGP has nothing to do with security, ciphers, etc - it's tooling.
  - ilyt 3y ago
    Isn't it just "the problem is hard enough that tooling have to be complicated" ? I don't believe that in 20+ years "nobody found a good UI/UX designers for it"
  - woodruffw 3y ago
    It’s both: OpenPGP’s mandatory primitives are not great. There are extension RFCs for more modern primitives, but they aren’t mandatory.
c00lio 3y ago
The OpenPGP stuff in Germany is not officially required to be accepted as a paper signature replacement anywhere. They are just doing this as an advertisement for the eID/ePA electronic RFID passport functionality that nobody wants.
c0rrupted 3y ago
OpenPGP is pretty good, I don't get why it gets criticism to be honest. It even has support for quantum resistant cryptography now if I recall correctly. It's also pretty easy to use. OpenKeyChain for Android works great. So does Kleopatra on Linux. Even thunderbird has support for it
- phkx 3y ago
  I recently came along this post [0], which pretty much killed PGP for me. I certainly cannot follow all technical detail in the post, but I do see that cryptography has moved on and now offers e.g. forward secrecy. [0] https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
  - phkx 3y ago
    I should add that some of the risks mentioned in that post can be mitigated by proper user behavior (use a sufficient key length, limit the lifetime of your key). But then PGP is sufficiently complex and error prone (in using it and apparently in its technical complexity), that I don’t believe that it scales to everyone and their grandma using it.
  - upofadown 3y ago
    I found the "The PGP Problem" fairly misleading: * https://articles.59.ca/doku.php?id=pgpfan:tpp https://articles.59.ca/doku.php?id=pgpfan:tpp Who would want to immediately destroy their access to their received emails in the name of forward secrecy?

varjag 3y ago

The jab at OpenPGP feels unnecessary when your yardstick is an FSB signature using a GOST.

thriftwy 3y ago
The problem with OpenPGP has nothing to do with security, ciphers, etc - it's tooling.
- ilyt 3y ago
  Isn't it just "the problem is hard enough that tooling have to be complicated" ? I don't believe that in 20+ years "nobody found a good UI/UX designers for it"
- woodruffw 3y ago
  It’s both: OpenPGP’s mandatory primitives are not great. There are extension RFCs for more modern primitives, but they aren’t mandatory.

c00lio 3y ago

The OpenPGP stuff in Germany is not officially required to be accepted as a paper signature replacement anywhere. They are just doing this as an advertisement for the eID/ePA electronic RFID passport functionality that nobody wants.

c0rrupted 3y ago

OpenPGP is pretty good, I don't get why it gets criticism to be honest. It even has support for quantum resistant cryptography now if I recall correctly. It's also pretty easy to use. OpenKeyChain for Android works great. So does Kleopatra on Linux. Even thunderbird has support for it

phkx 3y ago
I recently came along this post [0], which pretty much killed PGP for me. I certainly cannot follow all technical detail in the post, but I do see that cryptography has moved on and now offers e.g. forward secrecy. [0] https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
- phkx 3y ago
  I should add that some of the risks mentioned in that post can be mitigated by proper user behavior (use a sufficient key length, limit the lifetime of your key). But then PGP is sufficiently complex and error prone (in using it and apparently in its technical complexity), that I don’t believe that it scales to everyone and their grandma using it.
- upofadown 3y ago
  I found the "The PGP Problem" fairly misleading: * https://articles.59.ca/doku.php?id=pgpfan:tpp https://articles.59.ca/doku.php?id=pgpfan:tpp Who would want to immediately destroy their access to their received emails in the name of forward secrecy?