Towards Sequoia OpenPGP v1.0

https://sequoia-pgp.org/blog/2020/04/26/202004-towards-sequoia-v1.0/

by nwalfield • 6 years ago

83 59 6 years ago

sequoia-pgp.org

pgt• 6 years ago

Note that this project is unrelated to Sequoia Capital.

cpach3• 6 years ago

I guess it's a reference to Sequoyah https://en.wikipedia.org/wiki/Sequoyah

DyslexicAtheist2• 6 years ago

note that Sequoia Capital is totally unrelated to the Indian silversmith and inventor of the Cherokee syllabary

cpach3• 6 years ago

IMO, encrypted e-mail is a dead end. Latacora has a good blog post about it that I highly recommend: https://latacora.micro.blog/2020/02/19/stop-using-encrypted....

gwd• 6 years ago

That post should really be called, "Stop using email". Which is fine when you don't need something like email. But sometimes you do.

qqii10• 6 years ago

Although I agree with your point, both the article and your comment suffer from different use cases + threat models.

I'd agree that there are no real alternatives to (regular) mail and email where longer form asynchronous communication can occur without the expectation of an instant reply.

Unfortunately when it comes to this form of communication the reality is that there aren't any widely used alternatives that don't leak as much metadata as email.

dr_hooo• 6 years ago

Hmm, I don't really see any really convincing points, or workable alternatives that your linked article provides.

Nevertheless I would like to read more about this claim:

It [PGP] was designed in the 1990s, and in the 20 years since it became popular, cryptography has advanced in ways that PGP has not kept up with. So, for example, it recently turned out to be possible for eavesdroppers to decrypt messages without a key, simply by tampering with encrypted messages. Most technologists who work with PGP don’t understand it at a low enough level to see what’s wrong with it.

(I admit I am one of these technologists)

dependenttypes• 6 years ago

It is talking about things like efail.

upofadown7• 6 years ago

My best guess is that they really meant EFAIL but didn't want to actually mention it because EFAIL had nothing to do with any weakness in the OpenPGP standard or the GnuPG implementation. Instead it was a HTML email horror story where someone figured out how to forward entire decrypted messages using image links.

So just more pointless anti-PGP innuendo...

steerablesafe• 6 years ago

Whenever someone criticizes email encryption they fail to provide an actual replacement. Encrypted instant messaging is an alternative, but it's not a replacement.

m-p-32• 6 years ago

And yet encrypted instant messaging would have the same pitfalls if the platforms where federated like email is.

It only works well and seamlessly because it works within a single provider.

laumars• 6 years ago

PGP is used for more than just email

qqii10• 6 years ago

The writer of the article wrote another one that is linked where he criticises other uses of PGP[0].

[0] https://latacora.micro.blog/2019/07/16/the-pgp-problem.html

m-p-32• 6 years ago

Agreed, can be used for signing git and other stuff. PGP isn't only about encryption, it's also about authentication and integrity.

tptacek4• 6 years ago

I wrote an actual piece about PGP:

https://latacora.micro.blog/2019/07/16/the-pgp-problem.html

I stand by what I wrote in this post as well, but it's not a good first read for people surprised that cryptographers hate PGP.

cpach3• 6 years ago

Perhaps I should have linked to both essays. People should read them both :) The reason I linked to the other one was that encrypted mails is the first use case listed on the Sequoia site.

qqii10• 6 years ago

Having an alternative implementation to GnuPG is a pretty important. Although many would argue against the use of PGP encryption for many use cases such as email, there are other use cases where PGP's ideas have no replacement.

For a specific example take signing git commits. Even fossil scm delegates this task to pgp. Personally keybase is the only project that may provide some form of alternative, but they do so by supporting pgp.

I definitely agree that PGP was and is no longer the correct tool for every use case as it sort out to be, but I find there are still pockets where PGP has no alternative. I'd be interested what HN's thoughts are on PGP for this specific use case and if there could be an alternative.

Leace3• 6 years ago

Personally keybase is the only project that may provide some form of alternative, but they do so by supporting pgp.

Why keybase? Reading their crypto page (https://keybase.io/blog/crypto) leaves the impression that they took PGP and embrace-extend-extinguished it...

qqii10• 6 years ago

I'm not endorsing keybase, in fact I have much of the same criticisms as you probably do.

The fact is unlike many PGP replacements most don't attempt to solve similar ideas as the "web of trust". For those that I know do, the cryptocurrency/tokens one's don't even consider backwards compatability. As far as I know keybase are the only ones that embrace PGP and are therefore backwards compatible with git, fossil, etc's commit signing.

It may be ignorance but I don't see linux, git or any other software project that "needs" both version control and verifiable commits moving from PGP signing to something else, but rather PGP signing dying out with the rise of git platforms like github, gitlab, etc. If you squint you can see that keybase provides some form of alternative.

forgotmypw166• 6 years ago

I'm using OpenPGP.js for drop-in decentralized client-side authentication for my web-based message board.

This has several benefits, which includes giving technically-savvy users to do their own key generation and message signing using whatever tools they prefer, using one of the most widely used encryption/signing standards in existence.

Meanwhile, non-technical users can create a new profile with literally one click and a couple seconds of compute time on their device. They can then back up the key as a text-file and use it on any compatible site.

I think that the potential of PGP has barely been grazed by Keybase, and there are many more applications than we've even hypothesized so far.

swiley• 6 years ago

You should definitely not be encouraging your users to give their private keys to js on other sites, that’s just as bad (or maybe worse) as encouraging them to reuse passwords.

qqii10• 6 years ago

That sounds really interesting, would you be willing to share a link to the message board so I can see what your account creation process looks like? The other most common place I've seen PGP used as an account identifier are in darknet markets, where users are warned to use a GPG binary from a trusted source and against whatever serverside system that was built for ease of UX.

Related to the issue that swiley mentions, I'm not really sold that attributing the user to a string of digits is good UX, whereas I like how keybase puts a distinction between identity and secrets.

A "keybase proof" simply shows that at some point a singular identity had access to a multitude of accounts, but has no guarantees about the current account holders. This may seem like a negative but shifting the responsibility onto account holders to protect their secrets is more reasonable than assigning the identity of an individual to a single, long term secret [0] or deal with key transition.

[0] https://latacora.micro.blog/2019/07/16/the-pgp-problem.html#...

nickray2• 6 years ago

First, that's a limitation of git.

Second, it's easy to fake PGP: https://boats.gitlab.io/blog/post/signing-commits-without-gp...

Third, we're adding support to SoloKeys to do this using a hardware token: https://github.com/solokeys/solo/issues/395#issuecomment-612...

We're also collaborating with https://keys.pub/ to make "sign/verify" use cases easily usable with a GUI for everyone. So I'd say there's hope?

upofadown7• 6 years ago

Second, it's easy to fake PGP:

An odd way to put it, but yes, the simplicity of the OpenPGP standard is one of its greatest strengths. Somehow the standard has resisted just a ton of stuff that would be pointless over the long term over a great many years.

jeltz2• 6 years ago

Your linked post is not about faking PGP, it is about replacing PGP with his own implementation which supports only a subset of the PGP standard, the subset necessary to properly sign git commits.

qqii10• 6 years ago

I've not made myself very clear in the comment, but git and fossil scm are simply examples that delegate issues of trust to PGP's web of trust. Hardware keys are more secure, but from my understanding still stuffer from the same issue PGP does - a physical device is not an identity. keys.pub looks very interesting, but it seems that like keybase it doesn't address everyone's concerns[0].

From a technical perspective if keys.pub exists there's no reason that the proof process could occur at a layer above git rather than within git in some form of "social proof sidechain"-like structure.

I'm definitely going to keep an eye on key.pub, once they've addressed some of their coming soon items they'll be a very nice contender to keybase.

[0] https://news.ycombinator.com/item?id=22994650

lstoll• 6 years ago

Git also supports S/MIME, and GitHub provides a tool to sign commits with this directly https://github.blog/changelog/2018-09-10-smime-signature-ver...

jcranmer• 6 years ago

S/MIME and PGP share the same basic problem: they provide a container for the basic public-key crypto primitives (signing and encryption) together with an identification of the public key and leave it at that. Throw on top of that tools that are usually uninterested in actually thinking about how policy decisions affect cryptographic security and you have an example of security theater.

qqii10• 6 years ago

I've seen similar projects that use S/MIME for identity management, but as seen from the README of the tool[0] the benefits of PGP's web of trust can be seen in unstructured environments. Online identities are perhaps the most unstructured environment, where aliases and personas are the norm.

[0] https://github.com/github/smimesign

mratsim• 6 years ago

What's the threat model?

I've looked into the code. It uses Nettle's Curve25519 which seems to be implemented constant-time (assuming ECC mul is using "ecc-mul-g" from which is protected against cache timing attacks because the other ecc-mul implementations are using raw table access.)

longtermd• 6 years ago

Off topic af: what does the picture on their landing page symbolize? https://sequoia-pgp.org/

qqii10• 6 years ago

https://wellcomecollection.org/works/s8yb9bt9

superdug• 6 years ago

I still use PGP to encrypt files with secrets in them that I am sending to a known source, and I know it's still the base encryption for a few well known file servers. A new player in the market is welcomed.

nickray2• 6 years ago

Keybase's "Crypto tools" tab can do this, with "known destination" determined via social proof.

https://keys.pub is a re-implementation of this use case without the messenger/cryptocurrency baggage that some dislike about Keybase.

jolmg• 6 years ago

Here's the command line documentation:

https://docs.sequoia-pgp.org/sq/index.html

I have to admit that it looks more digestible than gpg's. It seems it's still missing a way to manage OpenPGP smartcards like Yubikeys. Also, I can't see a way to manage an arbitrary set of subkeys for a given primary key.

I'm really happy to see an alternative to GnuPG, though. This looks promising.

saurik• 6 years ago

As someone who has been trying to use this library but haven't had the time to finish build integration to cross compile for all of my target platforms, I really wish it weren't using nettle, particularly as it is also using openssl :(. Does rust not have useful cryptography libraries yet? Or couldn't it just openssl?

Towards Sequoia OpenPGP v1.0

Related Stories