5 ms·

Everyone is trying so hard to re-invent PGP, while parroting that PGP is dead because some security influencers said so. Well, there is a LOT of ongoing PGP mo

by lrvick 5mo ago

Everyone is trying so hard to re-invent PGP, while parroting that PGP is dead because some security influencers said so. Well, there is a LOT of ongoing PGP modernization work on both specifications and implementations in recent years and my team and I at Distrust will be publishing a writeup on it any day now, as well as organizing yet another key generation and signing party in San Francisco next month. PGP is not going away any time soon, and it is more relevant than ever. For now check out this post about how we use it to build trust in the Linux ecosystem today: https://kron.fi/en/posts/stagex-web-of-trust/ https://kron.fi/en/posts/stagex-web-of-trust/

growse 5mo ago
> Everyone is trying so hard to re-invent PGP Which bit of PGP?
- lrvick 5mo ago
  Self-sovereign PKI identity, key discovery, file encryption, artifact, code, review signing, security disclosures, boot signing etc etc.
  - growse 5mo ago
    Who's reinventing a tool that can do all that?
    - Grosvenor 5mo ago
      No one. The influencers are simply telling you you're wrong if you think you need that. Which is the thing, we do need a single key that can be used for all those things. So we get PGP.
      - growse 5mo ago
        > No one. I thought everyone was "trying so hard to re-invent PGP". > we do need a single key that can be used for all those things We do? This is not obvious. Why does my disk encryption key need to be the same that I use to sign binaries that I release?
        lrvick 5mo ago
        It is hard enough for people to keep up with one keychain, let alone a dozen of them for every use case in their lives. PGP keychains allow you to have a single 24 word mnemonic seed to recover your entire digital identity, data access, etc. The UX is strictly better than the commonly suggested hodge podge of flavor of the week alternatives. Standards make interoperability a lot easier.
  - noman-land 5mo ago
    Don't forget authentication! Been using pgp keys on smart cards as ssh keys for ages.
noman-land 5mo ago
One thing I don't like about key signing is that 1. You reveal your social graph 2. Different instances of the key can be differently signed For someone to sign your key that information has to be stored on your key or in a central location.
- purplehat_ 5mo ago
  The first bit seems possibly solvable with private set intersection. You can publish a salted hash of everybody you trust, and I can compute hashes of everyone I trust with your salt to see if we have anyone in common. Then I check the signature corresponding to the salted hash I like, and hopefully it doesn't reveal anything you don't want to reveal. I don't know if anyone has actually done this in practice. Does it work?
  - lrvick 5mo ago
    Having a public graph is critical for trust in Linux distributions. All it means is a human met you and agreed you are human and signed your key. It does not imply you are friends. It is pretty useful for someone totally outside the trust graph to be able to prove the key that just signed the latest release of stagex is only a couple steps away from the keys that sign debian and the Linux kernel. Keys that long predate AI. Public trust accountability is exactly what we want from people responsible for the legos that make up the internet. You can of course have private signature packets revealed as needed though.
    - tptacek 5mo ago
      People are not Linux distributions.
      - lrvick 5mo ago
        But Linux distributions are made of people.
sabedevops 5mo ago
I've struggled with PGP with the idea that I can't quite express "I'm signing as this specific User ID by using this specific signing subkey"... The only way I've found to reliably express that is to maintain completely separate keys. Is there anything in the works to give ergonomics around this?
- lrvick 5mo ago
  You should only be signing other peoples keys with your master key which should never touch an internet connected operating system. Subkeys should have limited privileges and be easy to lose or rotate as needed, but can all live under the same master offline identity key, which acts like a personal CA.
tptacek 5mo ago
No part of what's being proposed here has anything to do with PGP. They aren't proposing a "web of trust" with "key servers". They're proposing an immutable binding between names and key identities. PGP's "self-sovereignty" comes from mutually agreeing with groups of people who already know each other to exchange files establishing identities. That is to trusted identity what the one time pad is to cryptography: a punt on the entire problem space.
- lrvick 5mo ago
  > PGP's "self-sovereignty" comes from mutually agreeing with groups of people who already know each other to exchange files establishing identities. Or between total strangers that met in person at a key signing party and agreed "you look like a human and not a bot to me". We need human identity to be certified by humans using very long lived standard PKI primitives. Anything else, bots can easily monopolize to the point of being useless. Rather than debate this here though yet again, I am working on a blog post which includes a lot of quotes, including one from you, to make a case for why PGP is still the best and most widely used and useful proof-of-human and self-sovereign PKI solution that exists, and why we should double down on it. That comment thread is sure to be interesting.
  - tptacek 5mo ago
    That's fine! It's perfectly reasonable to say "this isn't a problem worth solving". But you can't then say something else actually solves the problem by punting on it. Be clearer about what you're saying, instead of invoking the specter of "security influencers".
    - lrvick 5mo ago
      I am not saying it is not a problem worth solving. I am actually saying PGP actually solves the problem of which key actually belongs to which person. There are dozens of keys claiming to be Torvalds that lack credible endorsements from high reputation identities, so those are easily ignored. The one that has been signing the Linux kernel for years and signed by many people putting their reputations on the line is the one we care about. It is intuitive and does not need a math degree to understand.

by lrvick 5mo ago

growse 5mo ago

> Everyone is trying so hard to re-invent PGP Which bit of PGP?

lrvick 5mo ago
Self-sovereign PKI identity, key discovery, file encryption, artifact, code, review signing, security disclosures, boot signing etc etc.
- growse 5mo ago
  Who's reinventing a tool that can do all that?
  - Grosvenor 5mo ago
    No one. The influencers are simply telling you you're wrong if you think you need that. Which is the thing, we do need a single key that can be used for all those things. So we get PGP.
    - growse 5mo ago
      > No one. I thought everyone was "trying so hard to re-invent PGP". > we do need a single key that can be used for all those things We do? This is not obvious. Why does my disk encryption key need to be the same that I use to sign binaries that I release?
      - lrvick 5mo ago
        It is hard enough for people to keep up with one keychain, let alone a dozen of them for every use case in their lives. PGP keychains allow you to have a single 24 word mnemonic seed to recover your entire digital identity, data access, etc. The UX is strictly better than the commonly suggested hodge podge of flavor of the week alternatives. Standards make interoperability a lot easier.
- noman-land 5mo ago
  Don't forget authentication! Been using pgp keys on smart cards as ssh keys for ages.

noman-land 5mo ago

One thing I don't like about key signing is that 1. You reveal your social graph 2. Different instances of the key can be differently signed For someone to sign your key that information has to be stored on your key or in a central location.

purplehat_ 5mo ago
The first bit seems possibly solvable with private set intersection. You can publish a salted hash of everybody you trust, and I can compute hashes of everyone I trust with your salt to see if we have anyone in common. Then I check the signature corresponding to the salted hash I like, and hopefully it doesn't reveal anything you don't want to reveal. I don't know if anyone has actually done this in practice. Does it work?
- lrvick 5mo ago
  Having a public graph is critical for trust in Linux distributions. All it means is a human met you and agreed you are human and signed your key. It does not imply you are friends. It is pretty useful for someone totally outside the trust graph to be able to prove the key that just signed the latest release of stagex is only a couple steps away from the keys that sign debian and the Linux kernel. Keys that long predate AI. Public trust accountability is exactly what we want from people responsible for the legos that make up the internet. You can of course have private signature packets revealed as needed though.
  - tptacek 5mo ago
    People are not Linux distributions.
    - lrvick 5mo ago
      But Linux distributions are made of people.

sabedevops 5mo ago

I've struggled with PGP with the idea that I can't quite express "I'm signing as this specific User ID by using this specific signing subkey"... The only way I've found to reliably express that is to maintain completely separate keys. Is there anything in the works to give ergonomics around this?

lrvick 5mo ago
You should only be signing other peoples keys with your master key which should never touch an internet connected operating system. Subkeys should have limited privileges and be easy to lose or rotate as needed, but can all live under the same master offline identity key, which acts like a personal CA.

tptacek 5mo ago

No part of what's being proposed here has anything to do with PGP. They aren't proposing a "web of trust" with "key servers". They're proposing an immutable binding between names and key identities. PGP's "self-sovereignty" comes from mutually agreeing with groups of people who already know each other to exchange files establishing identities. That is to trusted identity what the one time pad is to cryptography: a punt on the entire problem space.

lrvick 5mo ago
> PGP's "self-sovereignty" comes from mutually agreeing with groups of people who already know each other to exchange files establishing identities. Or between total strangers that met in person at a key signing party and agreed "you look like a human and not a bot to me". We need human identity to be certified by humans using very long lived standard PKI primitives. Anything else, bots can easily monopolize to the point of being useless. Rather than debate this here though yet again, I am working on a blog post which includes a lot of quotes, including one from you, to make a case for why PGP is still the best and most widely used and useful proof-of-human and self-sovereign PKI solution that exists, and why we should double down on it. That comment thread is sure to be interesting.
- tptacek 5mo ago
  That's fine! It's perfectly reasonable to say "this isn't a problem worth solving". But you can't then say something else actually solves the problem by punting on it. Be clearer about what you're saying, instead of invoking the specter of "security influencers".
  - lrvick 5mo ago
    I am not saying it is not a problem worth solving. I am actually saying PGP actually solves the problem of which key actually belongs to which person. There are dozens of keys claiming to be Torvalds that lack credible endorsements from high reputation identities, so those are easily ignored. The one that has been signing the Linux kernel for years and signed by many people putting their reputations on the line is the one we care about. It is intuitive and does not need a math degree to understand.