3 ms·

I hope they don't work too hard to making it compatible with PGP (and probably shouldn't at all). Just through Gmail and Yahoo alone adopting it, the end-to-end

I hope they don't work too hard to making it compatible with PGP (and probably shouldn't at all). Just through Gmail and Yahoo alone adopting it, the end-to-end encrypted e-mail user base could increase by 100x. So it makes little sense to make it backwards compatible, especially if that creates potential security issues.

lallysingh 12y ago
One of the benefits of PGP is that it's stood up pretty well to the test of time. Incompatible changes would be a little suspect, from a security perspective.
- higherpurpose 12y ago
  PGP's lack of forward secrecy seems like a major flaw, unless they can somehow make it easier to have the benefits of PFS while keeping the current design. But didn't they already say they intend to use elliptic curve keys instead of RSA for much better performance? Wouldn't that already break compatibility with PGP? The only real downside I see from breaking PGP compatibility is that then the new system will need a few years before it can really be "trusted". However: 1) it already won't be very trusted since it happens in the browser, and it will be quite hard for Google to absolutely guarantee without a shadow of a doubt that they can't change any settings themselves (even though they own the Chrome browser and the Chrome store, on which the extension will live). 2) being new doesn't mean it can't be better. We already have better secure messaging crypto protocols such as Axolotl, so it is possible to make one that's both new and better. (I actually wonder why we can't just use Axolotl for an email interface, and call it a day?!).
  - unethical_ban 12y ago
    Forward secrecy on PGP? So I can't go read my old love letters?
    - mjevans 12y ago
      Forward security typically means you make it possible, after the session is complete, for anyone to have said anything during the session. Thus making it possible for any potential log of said session to be forged and presented as 'evidence'; therefore implying that even a log which happens to exist on someone's computer is in fact forged (or more to the point, that any potentially recovered log or monitored log is forged; even if an identity has signed off on the session key). So if 'PFS' was used with a sent message then anyone/everyone would be able to read or forge the message. This is not the problem that PGP/OpenPGP was designed to solve.
      - Tomte 12y ago
        No, that's deniability (OTR has that property), something very different from PFS. PFS just means you've got session keys that can't be derived from the long lived authentication key.
  - rakoo 12y ago
    > PGP's lack of forward secrecy PFS doesn't really exist in the case of emails, it makes more sense in the context of a real-time conversation. In the context of a conversation you typically create a session that is symmetrically agreed upon by both parties and lives until one of the parties quit. This agreement includes a "session encryption key" that is completely random in the case of PFS (so it can't be used to infer other session's encryption keys, that's the point). You then use this key for the whole duration of the session (with careful re-keying at some point otherwise it's pointless) PGP goes even beyond: there's no session, and each message is encrypted with a different key. If you had to draw a parallel, it would be as if only one party is enough to decide the parameters of a session, and all parameters would still be changing every time. Also, each session is only ever used for 1 message. If you really want to draw the parallel, then PGP is the ultimate PFS. > I actually wonder why we can't just use Axolotl for an email interface, and call it a day?! Because the number 1 problem in cryptography for a decentralized end-user product is not the cipher or the algorithms or do we use Elliptic Curves or whatever, it is the distribution of keys. The Axolotl ratchet is awesome, but it's only a ratchet. PGP has some stuff related to key distribution and verification, TLS has some. If we are to implement global scale email cryptography, it will more likely be on top of PGP or TLS than anything else.

lallysingh 12y ago

One of the benefits of PGP is that it's stood up pretty well to the test of time. Incompatible changes would be a little suspect, from a security perspective.

higherpurpose 12y ago
PGP's lack of forward secrecy seems like a major flaw, unless they can somehow make it easier to have the benefits of PFS while keeping the current design. But didn't they already say they intend to use elliptic curve keys instead of RSA for much better performance? Wouldn't that already break compatibility with PGP? The only real downside I see from breaking PGP compatibility is that then the new system will need a few years before it can really be "trusted". However: 1) it already won't be very trusted since it happens in the browser, and it will be quite hard for Google to absolutely guarantee without a shadow of a doubt that they can't change any settings themselves (even though they own the Chrome browser and the Chrome store, on which the extension will live). 2) being new doesn't mean it can't be better. We already have better secure messaging crypto protocols such as Axolotl, so it is possible to make one that's both new and better. (I actually wonder why we can't just use Axolotl for an email interface, and call it a day?!).
- unethical_ban 12y ago
  Forward secrecy on PGP? So I can't go read my old love letters?
  - mjevans 12y ago
    Forward security typically means you make it possible, after the session is complete, for anyone to have said anything during the session. Thus making it possible for any potential log of said session to be forged and presented as 'evidence'; therefore implying that even a log which happens to exist on someone's computer is in fact forged (or more to the point, that any potentially recovered log or monitored log is forged; even if an identity has signed off on the session key). So if 'PFS' was used with a sent message then anyone/everyone would be able to read or forge the message. This is not the problem that PGP/OpenPGP was designed to solve.
    - Tomte 12y ago
      No, that's deniability (OTR has that property), something very different from PFS. PFS just means you've got session keys that can't be derived from the long lived authentication key.
- rakoo 12y ago
  > PGP's lack of forward secrecy PFS doesn't really exist in the case of emails, it makes more sense in the context of a real-time conversation. In the context of a conversation you typically create a session that is symmetrically agreed upon by both parties and lives until one of the parties quit. This agreement includes a "session encryption key" that is completely random in the case of PFS (so it can't be used to infer other session's encryption keys, that's the point). You then use this key for the whole duration of the session (with careful re-keying at some point otherwise it's pointless) PGP goes even beyond: there's no session, and each message is encrypted with a different key. If you had to draw a parallel, it would be as if only one party is enough to decide the parameters of a session, and all parameters would still be changing every time. Also, each session is only ever used for 1 message. If you really want to draw the parallel, then PGP is the ultimate PFS. > I actually wonder why we can't just use Axolotl for an email interface, and call it a day?! Because the number 1 problem in cryptography for a decentralized end-user product is not the cipher or the algorithms or do we use Elliptic Curves or whatever, it is the distribution of keys. The Axolotl ratchet is awesome, but it's only a ratchet. PGP has some stuff related to key distribution and verification, TLS has some. If we are to implement global scale email cryptography, it will more likely be on top of PGP or TLS than anything else.