OpenPGP really works

https://www.foo.be/2016/12/OpenPGP-really-works

by ergot • 10 years ago

143 68 10 years ago

tptacek2• 10 years ago

As a sort of basically reliable swiss army knife for file-based encryption problems, the kinds of problems you'd otherwise use AES passphrase-encrypted ZIP files to solve, PGP not only works but also has a bad rap.

And there are a lot of those problems! Maybe even the majority of them!

But PGP was designed for message encryption, and it's a poor choice for message encryption. The community is gradually converging on the idea that SMTP store-and-forward email is just never going to be cryptographically safe, and pretty much the only messaging application in which PGP makes any sense is SMTP email.

What's worse is, much of the PGP ecosystem really only makes sense in a messaging context. Which means that the complex parts of PGP, like key servers and subkeys and things like that, aren't really adding value, but still confuse and distract users.

lovich• 10 years ago

A little off topic but could you point me towards some resources for learning about what pgp was meant to solve? I've read back and forth opinions about it on hackernews,reddit, etc but I've not seen a definitive description of how it attempts to solve the problem of encrypted communication that wasn't heavily editorialized.

cpach• 10 years ago

These links might be interesting to you: http://www.pgpi.org/doc/

WorldMaker• 10 years ago

A lay nutshell summary: there is one giant problem in crypto systems since the dawn of time; how to distribute the keys to locked documents/files and keep those keys out of the "wrong hands". For the majority of history of cryptology, the only option was symmetric keys (the same key is used to lock the document as to unlock it). This is conceptually simple (she who has the key has the access), but at the cost of making distributing these keys a giant challenge of secrecy (anyone can intercept that key in transit and use it to unlock documents; worse, someone can intercept that key and the people who are supposed to use the key might not even be aware someone could be snooping).

Asymmetric key algorithms, where the key used to unlock the document is different from the key used to lock it, were long considered the "holy grail" for cryptography. With an asymmetric key, I can closely guard the "unlock key" (private key), but shout out the "lock key" (public key) from the rooftops or post it on flyers and anyone could send me documents in secret that only I could unlock. (That unlocks the next, and still current, major problem in that how do you as someone looking to send a secret document to me trust that the person shouting that night from the rooftops or posting that flyer is actually me, much less know which flyers to look for or that I might shout it sometimes from rooftops...)

PGP was the first software built "for the masses" that made asymmetric key crypto accessible to the "common computer users".

(PGP is also notable for attempting to build one such potential trust system to find/trust keys, the Web of Trust model. This is where most of the contemporary arguments about the value of PGP these days are targeted. The Web of Trust is a useful solution, but its a complicated solution that doesn't scale as well as it should and has a bad user experience with a sharp learning curve and a long tail of key management complications for even power users.)

DanBC• 10 years ago

> As a sort of basically reliable swiss army knife for file-based encryption problems, the kinds of problems you'd otherwise use AES passphrase-encrypted ZIP files to solve, PGP not only works but also has a bad rap.

I have a text file. I encrypt it using a key. I send you the encrypted text file. How do you decrypt it? You need the key.

If I can send you the key securely why don't I just send the plain message using that secure mechanism?

Public key cryptography solves that problem.

j_s• 10 years ago

Secure communication with PGP is a pain.

https://gist.github.com/grugq/03167bed45e774551155

tedunangst2• 10 years ago

If you just want to encrypt a file, scrypt works well for this purpose.

twr• 10 years ago

I didn't know Colin also wrote an encryption utility that uses the scrypt KDF. It does seem better than using GPG to password encrypt files.

noinsight• 10 years ago

AES passphrase-encrypted ZIP files

7-Zip is pretty awesome for actually usable encryption. On Windows, with the Explorer integration, you can just right click a file, select "Add to archive" and create an AES-256 encrypted 7-Zip archive that anyone with 7-Zip can extract just by entering the password.

s-phi-nl2• 10 years ago

Could you give an example of "problems you'd otherwise use AES passphrase-encrypted ZIP files to solve"? Do any of them involve sending the data anywhere (i.e., the sender and receiver are the same person)?

s-phi-nl2• 10 years ago

I think my question is now answered by https://news.ycombinator.com/item?id=13383171, in particular https://news.ycombinator.com/item?id=13383211.

SFJulie2• 10 years ago

No one criticizes openPGP on the crypto point of view.

It is the UX/UI experience that anger people to the highest point. Noobs like long time users.

Correct key handling (signing, revoking, publishing and sometimes doing actually the job) is a burden.

Nothing is wrong with the code so far. Much more whatever correct the software is, it is a pain.

My guess, is that true correct cryptography requires this burden whatever the algorithms are because ensuring identity are trustable is where the more work is, and no software can do it.

dom0• 10 years ago

No one criticizes openPGP on the crypto point of view.

Hm?

Of course PGP is criticized for that, just less vocally.

- Authentication is off by default in GPG

- Even so, it's very complex, and most of the protocol isn't authenticated

[ This is problematic, because ciphers tend to be more or less easily malleable, so non-signed messages can be tampered with; this is also an issue for encrypting files symmetrically ]

(- Compression is on by default and makes everything super-slow for no good reason)

- Widely used defaults for encryption and key derivation are rather arcane (eg. CAST5)

- PGP signatures, by principle, are non-repudiatiable, unlike most modern encrypted chat applications, so they prove to _anyone_ _forever_ that your key signed that message.

- PGP format announces all recipients to the world

- No forward secrecy possible

- ...

criddell• 10 years ago

Would the lack of perfect forward secrecy be considered a shortcoming?

dispose134324• 10 years ago

Web of Trust seems to be an inherently broken paradigm.

Think about this. Let's say I trust my friends (so when my friends sign John Doe is John Doe, it's really him). It's a big deal (not every friend is so security conscious, maybe he met this guy on facebook and looks so real), but would I trust someone because of a friends-friend's recommendation?

I know which friends are naive. But which friend's-friend's-friend is naive?

And those are the only web-of-trust connection I have with him? Can I trust him? Can I not? How do I tell?

subway2• 10 years ago

PGP already allows for this via "owner trust". When you sign a key, also indicate the level of trust you have in newly certified key's owner to certify other keys.

It's of course up to you to decide who you can trust to certify other keys.

edit: It's worth mentioning, "owner trust" is strictly a local attribute -- just because you fully trust John, and I fully trust you, my trust for John's certification of 3rd party keys remains unknown.

hannob• 10 years ago

The crypto in OpenPGP is actually far from ideal. They combine some arcane block cipher mode with something called mdc ("modification detection code"), which isn't a proper authentication. It's kinda surprising that this hasn't caused more issues (though there were some authentication stripping attacks). It should switch to a proper AEAD mode.

Also for RSA it is using PKCS #1 1.5 and SHA-1 is used all over the place.

This is all not super serious, I wouldn't be too bothered about it. But it's not a solid crypto design by modern standards.

sleepless2• 10 years ago

I have been using OpenPGP for years without problems. Key transition / exchange / verification can be a bit painful, but actually it is not that hard.

Also the longer you use OpenPGP, the less keys need to be verified. The start is very hard, since you start with no trusted keys at all. The longer you use it, the more fluent usage becomes.

Have been using GPG Suite on macOS and the only problem is, you may not get support for the new macOS on day 1 since apple provides no API for Mail.app. And then again, giving Apple some time to figure out their bugs of the intial major release isn't a bad idea.

FiloSottile• 10 years ago

Also the longer you use OpenPGP, the less keys need to be verified. The start is very hard, since you start with no trusted keys at all. The longer you use it, the more fluent usage becomes.

This is exactly what scares me and the point of my "I'm giving up on PGP" article. People holding on to keys forever, moving them from laptop to laptop, never rotating them and asymptotically approaching compromise... because it's the only way to ease the pain.

peatmoss• 10 years ago

How do you feel about Yubikey-based keys? Asking for a friend...

sleepless2• 10 years ago

What would you consider a sane key rotation cycle? 1 Month? 1 year, 2 years, 4 years?

jandrese2• 10 years ago

You gloss over the key management, but it is the primary failing of PGP (and GPG). The lack of built-in key management means it is only half of the solution, and the community has never managed to coalesce around a single sane solution. Instead we have people trading paper notes or using grotty services with custom protocols and if you just want to send an encrypted email to somebody there's no standard way to look up their key.

I have yet to find an email client that will even do the simple search of the keystores for you. It's maddening.

chakalakasp2• 10 years ago

The ultimate engineer's perspective. It works so well that almost nobody uses it!

Signal isn't even that popular compared to other platforms like iMessage, but I bet more people use it than regularly PGP.

I was regularly signing messages with PGP on Fidonet all the way back in '93 (and trying to find people to swap encrypted messages with). It's a bit mind blowing that the useability of the successor program today, GPG, isn't much better than what people thought was kinda wonkish and hard back in the Compuserve days.

hollander• 10 years ago

I sign almost all outgoing mail, hoping someone will notice. In three years I've got one question about it. Some people complain they can't open the attachment, as I use PGP/MIME to keep the message readable.

If big companies like Apple and Google were behind this, it could change, but I'm afraid this won't happen unless there is a sudden need for it.

wanderingbort• 10 years ago

If big companies like Apple and Google were behind this, it could change, but I'm afraid this won't happen unless there is a sudden need for it.

Digital privacy for average consumers needs more than a brand behind it, it needs an obvious value. I don't think many average people actually suspect that email _can_ be tampered with so, what does "signing" it mean to them.

Moreover, when/if it enters the mainstream it will be plagued with "hacks" which degrade the user-perceived value, causing many to abandon it if it isn't free.

by "hacks" I mean the users will expose keys and then blame AES :)

nihonde• 10 years ago

If ever there were a user group that should have forced pgp adoption, it is lawyers. When I worked at a big law firm, I lobbied for it and ran into a bunch of IT managers who had never heard of anything unless Microsoft sold it to them.

nhxu• 10 years ago

If big companies like Apple and Google were behind this, it could change, but I'm afraid this won't happen unless there is a sudden need for it.

End-to-end [1] is using OpenPGP.

[1] https://github.com/google/end-to-end/

tlikonen• 10 years ago

PGP (now GnuPG) is used more these days than in BBS (Fidonet) years, particularly in the open source community. Software releases and packages in GNU/Linux distributions are signed by the developers. All the time. It happens automatically without end-user noticing. Is this not one definition of "working well?" Lot's of people are passively using it without knowing.

But for messaging it's indeed very marginal. In open source projects' techical mailing lists and version control systems there is pretty much message or commit signing but that's a marginal group who does that.

astrodust2• 10 years ago

I'd believe PGP is in wider use today than Fidonet is, but not much wider.

I have to laugh that Snapchat has apparently solved the identity exchange problem and PGP is still stuck with these ridiculously baroque implementations.

matheusmoreira2• 10 years ago

Signal isn't even that popular

WhatsApp integrated¹ Signal's secure messaging protocol. Since then, at least one government was unable to compel² the company to produce unencrypted messages from users under investigation.

Given the popularity of WhatsApp, I think its safe to say a lot of people are now using a relatively secure messaging protocol.

¹ https://whispersystems.org/blog/whatsapp-complete/

² https://www.forbes.com/sites/parmyolson/2016/05/03/whatsapp-...

cyberpunk2• 10 years ago

I don't want to harp on about this again, but I really don't think you can put any sort of trust into such things as this. With GPG, you're producing an encrypted version of some text/data with a bit of code you can build yourself and run completely on your equipment, airgapped or whatever.

With signal/whatsapp, there is no way of even knowing if the code you're using "in app" is the code in github or in whatever rev wherever. Yes, I know reproducable builds -- but what stops the app fetching more code from elsewhere? Wanna bet there's a webview and some JS in that app somewhere?

It's nice to make things harder for the NSA to read, but this architecture seems to be just creating the illusion of safety and it's kind of weird to see how much advocacy it gets here when there are such obvious faults in it.

I'm not saying there's a better alternative, and congrats to all who are working on it and I'm happy to see it succeed -- but this isn't a solved problem and there's massive danger in trusting such things.

I'd love to have the time to really inspect whatsapp/signal to see what I'm sending/getting -- has anyone done this? Google isn't giving me much..

rvern3• 10 years ago

It isn't because GnuPG doesn't work well or because it is too hard to use that people don't use it. They don't use it because other people don't use it.

Why do people use Facebook instead of Diaspora? It's not because Facebook is better, works well, or is easier to use... It's because other people use Facebook.

Why do people use Skype instead of XMPP? It's not because Skype is better, works well, or is easier to use... It's because other people use Skype.

Why do people use WhatsApp instead of GnuPG or OTR? It's not because WhatsApp is better, works well, or is easier to use... It's because other people use WhatsApp.

It's always the same standard chicken and egg adoption problem. As shown in the article, GnuPG is used for package signing, commit signing, file encryption, and all sorts of things that don't involve many people. But when it's about communication, you can only use GnuPG if the people you want to communicate with use GnuPG too... and thus the adoption problem applies.

And the reason people initially used Facebook, Skype, and WhatsApp is not that they were easier to use or better. It's advertising. Notice how all of these are proprietary software made by companies with the means to advertise their software? You can bet people would use GnuPG, Diaspora, and XMPP if they had been advertised by companies like Facebook and Microsoft.

So if we want people to use open source software and open protocols instead of living in walled gardens, we need to advertise them. Advertising works.

dispose134324• 10 years ago

And the reason people initially used Facebook, Skype, and WhatsApp is not that they were easier to use or better. It's advertising. Notice how all of these are proprietary software made by companies with the means to advertise their software? You can bet people would use GnuPG, Diaspora, and XMPP if they had been advertised by companies like Facebook and Microsoft.

I know quite a few non-techies who use VLC, Firefox, LibreOffice, and other OS advertising-less projects. The difference is:

1. Facebook, Skype and WhatsApp solved problems others didn't and became big. Now it's too late to fight.

Had Diaspora been around before FB, and as easy to work with (put name here, picture here, password here, friend here. You're all set up. Let's go), or XMPP been around before Skype (which is a very old program in internet time), or Kontalk,Signal, etc. been around before WhatsApp (find friends by number, not by username), they probably would have taken off (at least to some degree).

Google came late onto the Desktop scene (Chromebooks) and are not successful while the incumbent (MS) is good.

MS came late onto the mobile scene and failed, while the incumbent (Google) is good.

cookiecaper2• 10 years ago

I just need to jump in here and harp on the thing that I'm sure regular readers of HN are sick of seeing me harp in on all the time. :P

The network effects of Facebook et al are entirely artificial! The beauty of the internet is that there are no real barriers to keep everyone in the same box. Instantaneous, exact communication is possible across the whole world now. "Other people can't hear me when I'm not using Facebook, so I have to use Facebook" is NOT an inherent problem in a digital system!

The problem is, simply, that the law in the United States, Europe, and most of the rest of the world explicitly makes it illegal to provide third-party federation systems that would bring that permeability to the "walled gardens" of the modern web.

The walls aren't really there. We don't need to install millions of miles of compatible cable to hook up diaspora and Facebook. We don't need the government to step in and do anything to stop the behemoths, we just need them to get out of the way. The web's natural mechanisms can solve this on their own if the USG stops putting developers and entrepreneurs in jail/financial ruin for trying to innovate.

Users need to be allowed to access sites with a browsing device of their own choice instead of allowing vendors to cut off access based on the use of browsing devices that preserve content, and then we need to update our copyright and contract law so that normal use of these browsing devices doesn't constitute infringement or breach.

Repeal the CFAA, fix the Copyright Act, retake the web from phony monopolies. Let's get these guys competing on merit again and make room for the revolutionary iterative improvements of the little guy.

zedred• 10 years ago

It isn't because GnuPG doesn't work well or because it is too hard to use that people don't use it. They don't use it because other people don't use it.

Sure, GnuPG works "well," for engineers. This post is written by an engineer, but engineers are no longer the majority of computer users. If you want to develop mass market products today, coming to terms with that is pretty important.

To even try to draw a comparison between WhatsApp and XMPP+OTR is absurd. For an engineer, maybe the latter is passable, but the billions of people around the world who want to chat on their mobile device, don't understand what a key exchange is, don't understand why they can't immediately see everyone in their address book they can chat with, and don't want to run their own server, it definitely isn't passable.

Why do people use Facebook instead of Diaspora? It's not because Facebook is better, works well, or is easier to use... It's because other people use Facebook.
Why do people use Skype instead of XMPP? It's not because Skype is better, works well, or is easier to use... It's because other people use Skype.
Why do people use WhatsApp instead of GnuPG or OTR? It's not because WhatsApp is better, works well, or is easier to use... It's because other people use WhatsApp.

I'm sorry but this is just not true. Network effects are important, but there's a reason that people are using these networks to begin with. They work really well.

Something like WhatsApp may seem simple, but every little interaction within the app is perfectly polished in a way that GnuPG, OTR, or any XMPP client is definitely not.

And the reason people initially used Facebook, Skype, and WhatsApp is not that they were easier to use or better. It's advertising. Notice how all of these are proprietary software made by companies with the means to advertise their software? You can bet people would use GnuPG, Diaspora, and XMPP if they had been advertised by companies like Facebook and Microsoft.

As far as I can tell, WhatsApp never spent a single dollar on advertising. Their entire growth strategy seems to have been word of mouth.

These companies have hundreds or thousands of engineers who work on these products full time every day, driving the products forward, making them better and better. That is not something an open source client is ever going to be able to compete with. It just isn't.

cedricbonhomme• 10 years ago

I see more and more comparisons between Signal and OpenPGP.

Signal is an application (in fact more than a simple application) that solves a more global problem (of communication solutions that uses asymmetric cryptography) which never was intended to be solved with OpenPGP.

OpenPGP is a standard. GnuPG, the tool that people are comparing with Signal (I think).

confounded2• 10 years ago

This applies to much of the XMPP discussion above, too. Also worth noting that GnuPG isn't even what you send the emails with. And that PGP on mobile is almost unheard of. I doubt I could explain how to send an PGP encrypted email (for example, to a doctor/lawyer/accountant) inside of 2 minutes.

Strong intrinsic motivation is the only reason people use PGP. It took me ~3 months to get a critical mass of 15 or so people on to Signal as first port of call.

openplatypus• 10 years ago

It is surprisingly easy to use PGP/GnuPG. Check this tutorial https://emailselfdefense.fsf.org/en/.

It is _just_ slightly more complex than using Twitter once configured.

confounded2• 10 years ago

It's the configuration that kills it, and a large part of that is loading context into the user's mind (the highest drop-out form).

kbart2• 10 years ago

No, even this step-by-step tutorial is not easy for "normal" user. It's plagued with obscure terms and concepts (keypair, keyserver, public key, web of trust, revocation certificate etc.). Sure, for us, developers/engineers/geeks, it looks trivial, but try to send this link to your grandma and see how it goes.

gnipgnip• 10 years ago

Interesting that Moxie wishes PGP were dead (inline with his views in the LibreSignal/Websocked/Gapps PR).

https://moxie.org/blog/gpg-and-me/

tibu• 10 years ago

My mobile Chrome is complaining about the site's certificate. Does this happen for others too? It seems it is having an issue with the issuer which is Let's Encrypt. Really strange.

alexnewman• 10 years ago

online and offline are both important. Is pgp implemented on any formally verified code base?

nickpsecurity• 10 years ago

No. I've only seen two, formal verifications of secure email with neither being PGP. I can't find the link to one but the other of Privacy-Enhanced Mail is here:

https://pdfs.semanticscholar.org/b6e2/3ac057b8716ebd4ab7831f...

They use Kesterel's Specware tools to essentially turn it from HOL properties to a formal design with code generation following. Kesterel was kind enough to open-source some of their stuff:

https://github.com/KestrelInstitute/Specware/

However, recent results in other tooling suggest the best way to go about it would be using tools like F* in miTLS, CRYPTOL, SPARK Ada, and/or Frama-C. Each component of a basic, subset of PGP has already been verified in isolation. Now, the algorithms just need to be fed into such tools, the protocol speced out miTLS-style, the integration proven sound, and object code shown to match the source. It looks doable with today's formal methods. More a matter of available labor and interest.

Khaine• 10 years ago

It doesn't

OpenPGP really works

Related Stories