4 ms·
>(a) Build a replacement GPG in a more modern development environment (c) Build a replacement GPG that developers can (easily) use as a cross platform library.
by unimpressive 13y ago
>(a) Build a replacement GPG in a more modern development environment
(c) Build a replacement GPG that developers can (easily) use as a cross platform library.
- dsl 13y agoThis has already been done by people who understand the fundamentals of crypto. Check out http://nacl.cr.yp.to/ http://nacl.cr.yp.to/ It is even available natively in Go http://godoc.org/code.google.com/p/go.crypto/nacl http://godoc.org/code.google.com/p/go.crypto/nacl
- tptacek 13y agoI thought I might have been this site's loudest proponent of Nacl, but maybe not? Here, though, Nacl isn't a useful suggestion; it isn't compatible with PGP. (There is a project that wrapped PGP's UX around Nacl's crypto, but one presumes it's virtually unused, since it can only talk to itself).
- dsl 13y agoI was trying to address the "library" aspect, but I agree NaCl is a poor replacement for GPG in user facing functionality. Anyone who is in need of crypto I push to NaCl, GPGME, or exec out to GPG itself before trying to build it themselves.
- jlgreco 13y agoNacl is good, but is Go a suitable language for crypto work yet? I understand there were some reservations in the past, though I can't recall exactly what those were.
- Jayschwa 13y agoI think Go is in a bit of a chicken-egg problem right now w.r.t. crypto. I recall one of the core devs saying you shouldn't use it for anything where security really matters, because their implementation hasn't really had the tires kicked. The tires probably won't be kicked as much with that sort of suggestion though either.
- bmm6o 13y agoThe only issue I recall is that the random-looking data involved in crypto confuses the conservative GC, so your app is unlikely to release memory in a timely fashion. More of a problem in the small address space of a 32-bit application.
- anotherhue 13y agoI was oblivious to this. Do you know of any projects using it to implement OpenPGP?
- edwintorok 13y agoAFAIK there are already two libraries that can deal with OpenPGP messages, it'd be better to improve one of the existing ones than rewrite it yet again from scratch :) * NetPGP (BSD licensed, recently imported into OpenBSD 5.4): http://www.squish.net/pipermail/odc/2013-March/014482.html http://www.squish.net/pipermail/odc/2013-March/014482.html * GPGME (GnuPG Made Easy, it invokes the gpg executable behind the scenes): http://www.gnupg.org/download/index.en.html#gpgme http://www.gnupg.org/download/index.en.html#gpgme http://www.gnupg.org/documentation/manuals/gpgme/ http://www.gnupg.org/documentation/manuals/gpgme/