A Schism in the OpenPGP World

https://lwn.net/SubscriberLink/953797/7222cd75661fb888/

by todsacerdoti • 3 years ago

138 258 3 years ago

If they want to jump the shark by crashing GnuPG into a compatibility reef, I won't be upgrading. "Don't break shit" is the first rule.

PS: Photon hosting private keys is, to me, a nonstarter. It makes their entire platform and investment in GPG pointless.

dale_glass5• 3 years ago

"Don't break shit" is the first rule.

It's not an important rule if security is your primary concern. Because if you "don't break shit", the first thing any adversary will do is to try downgrade things until an old, insecure state.

The way to counteract that is to refuse to downgrade, which obviously breaks shit if one of the sides can't speak the new protocol.

LtWorf9• 3 years ago

They want to change the protocol, for no clear advantage, not add bits to the encryption or change algorithm.

jwr5• 3 years ago

On a somewhat related note: GnuPG gets plenty of hate from the crypto crowd for being "obsolete" and insecure.

I would humbly propose that before you go telling everyone to stop using gpg, implement something that works, builds, and that doesn't break after 6 months or so. I've been using gpg for what, 20 years now? And recently (as in, three or four years ago) started using it with private keys stored on YubiKeys (using drduh's excellent guide). I also use it for symmetric encryption. It works. It doesn't break. It gets things done, and while I'm not secure from state-sponsored hackers, all this is infinitely better than no encryption.

Rage for example, is not in that category — I added it to my ansible automation as a test, and it broke after several months.

OfSanguineFire4• 3 years ago

When the crypto crowd complains about PGP being obsolete, they don’t just knock PGP, they very often mention alternatives. One of the most frequent recommendations is instead of using ordinary email and trying to bolt PGP onto it with individual contacts, use an encrypted messenger. I have been using Signal for four years now with the same install moved from phone to phone, and it has worked just fine. I can chat with my friends and relatives with E2E encryption, while I could have never got them to use PGP at all.

[0] https://moxie.org/2015/02/24/gpg-and-me.html

dig14• 3 years ago

When the crypto crowd complains about PGP being obsolete, they don’t just knock PGP, they very often mention alternatives

Those alternatives have different use cases compared to (open)PGP. So, Moxie said GPG is too complicated? If Signal goes down, how long will it take you to spin up your instance of server and clients, ready for delivery? How much would cost running reliably that infra? For email and GPG, I can get everything in 15-20 minutes, including registering the DNS name, DKIM, and SPF. I can also sign documents, images, and invoices with GPG; in short, I can do business. What can I do with Signal: chat, send nice emojis, and make calls?

Proper security and encryption isn't a toy, and let's not kid ourselves by skinning apps with shiny buttons and cool claims that everything people have done before sucks.

phone8675309• 3 years ago

Are you aware of any other widely deployed, stable tools that meet the other uses cases from the parent comment?

denton-scratch2• 3 years ago

Got it:

"There's a technical issue with email encryption, but we have a solution: don't use email! instead, use this different protocol, that doesn't work with email clients or email addresses, but instead uses a telephone number as an identifier!"

I've never tried Signal, because I don't want my telephone number used as my identifier.

A bug in email encryption can be fixed by fixing the bug; proposing a completely different protocol/application isn't fixing that bug, it's just saying that this other protocol/application doesn't have the same bug. It's not a solution; at least, not for me.

lucideer• 3 years ago

There's plenty of competition in the IM space for E2E realtime chat; none are positioning themselves as an alternative to email.

they don’t just knock PGP, they very often mention alternatives

What alternatives do they mention?

jwr5• 3 years ago

That solution won't let me encrypt my backups, I think.

Incidentally, Signal is another example of an impractical solution being pushed without consideration for practical requirements. Signal will LOSE ALL YOUR DATA if your phone (iOS) dies. There is no way to backup your chat history and images. It's been like that for years and we get silly features instead of this fundamental thing.

Yes, I know many people like it this way — you are in the minority, and there should be a configuration switch saying "do not backup my data". Most people do not expect that their entire history will be gone one day. Phones die, phones get stolen, and you expect you'll get your history and photos back when restoring from an (encrypted!) backup. Not so with Signal. So the next time you tell people to use Signal over WhatsApp, don't forget to tell them that Signal will lose everything one day, while WhatsApp will not.

Back to my original point: before anyone knocks "old obsolete" apps, consider carefully if the new shiny thing really does everything that the "old obsolete" app did, is it reliable, maintained, and will it stay around for 10+ years.

OhMeadhbh2• 3 years ago

I'm not sure I want to route all my email through my mobile phone.

Though yes... it's more secure than SMS.

klooney• 3 years ago

Why rage and not the canonical age?

knorker• 3 years ago

I've been using GPG for about as long, and I've had problems with it.

They've used some cipher, was it IDEA, than then got removed. So then I had to hunt down years old versions in order to be able to extract my old backups.

Or was that more of a PGP than GPG problem, and I misremember?

curiousq• 3 years ago

I don't understand cryptography, and I don't understand the particulars of the concerns that people have with GnuPG. I do know I've used it maybe once, and it wasn't straightforward.

You wrote: "I would humbly propose that before you go telling everyone to stop using gpg, implement something that works, builds, and that doesn't break after 6 months or so."

Keybase did some stuff and got tons of users. It even had a command-line client. It was all open source, too. Is there any reason that the crypto old guard hasn't just shamelessly copied Keybase? The most important being: its CLI (the design, not necessarily the implementation) and the overall "shape" of the project organization/structure. Why hasn't gpg been "uplifted" into a Keybase-shaped "shell" for people to interact with? I.e. at both the tool level and at the collaborative project level?

RMS came from the AI lab working on Lisp machines. Despite this, he recognized that a UNIX-shaped project was the correct vehicle for his vision, given its growing popularity. Why haven't the GPG folks given up on trying force people to do things their traditional way and attached their cart to a horse that has legs?

henriquez• 3 years ago

“Merge and decist” - these are some strong words. Particularly when the previous paragraphs called for a de-escalative approach and a meeting of minds. I don’t see how public admonishment could possibly be productive towards the stated goals.

sleepless2• 3 years ago

Did you read through the linked issue in total?

robertlagrant2• 3 years ago

It's obviously hard to judge from the outside, but the linked issue conversation definitely casts the reviewer in a bad light.

sleepless2• 3 years ago

Nice writeup.

It is a serious problem that the ecosystem is held back by wasting resources on personal disputes with immediate consequences for end users.

Hate on OpenPGP all you want, it still is an important technology with unrealized potential and growth.

femiagbabiaka• 3 years ago

It’s not actually clear from reading through this document or others, or the linked email threads, etc. that there is a personal dispute at play, or what that might be. I’m also not sure who the target of this document is, or who wrote it. It’s also not clear what the forcing function behind the strong recommendations at the end is — will the author fork GnuPG in the event a resolution can’t be reached?

freedomben• 3 years ago

It doesn't sound like a personal dispute to me, it sounds technical. One camp (Open) wants to move faster and break backward compatibility, the other (Libre) wants to move slower and maintain backwards compatibility

daveguy2• 3 years ago

It seems like maintaining backwards compatibility would be important for something that otherwise irreversibly encrypts your data.

throw0101b2• 3 years ago

One camp (Open) wants to move faster and break backward compatibility, the other (Libre) wants to move slower and maintain backwards compatibility

There is no breaking of backward compatibility. The crypto-refresh draft and the LibrePGP draft are equally backward-compatible.

See 'A Critique on “A Critique on the OpenPGP Updates”':

* https://blog.pgpkeys.eu/critique-critique

Both groups would create a new format (Libre = v5; crypto-refresh = v6). v4-only wouldn't be able to handle either new format, and newer software could presumably be told to create files in the older format.

The Proton folks are choosing to support both v5 and v6:

* https://github.com/ProtonMail/go-crypto/pull/182

As is the Thunderbird/RNP team:

* https://github.com/rnpgp/rnp/commit/fdfc1f5bb11d439e35f3c855...

nvy4• 3 years ago

I think the common refrain against PGP is that it shouldn't be important, because it suffers from a myriad of technical and sociological shortcomings.

The whole situation regarding key servers, key rotation, and the web of trust is a complete dumpster fire.

0xDEAFBEAD13• 3 years ago

The whole situation regarding key servers, key rotation, and the web of trust is a complete dumpster fire.

Can you explain why?

People elsewhere in this thread are saying that PGP sucks because it tries to do too many things at once, but it seems to me that the one big advantage of a tool which does everything at once is that you only need to solve authenticity one time for everything you do.

For example, if I'm communicating with an open source dev, having their known-authentic PGP key allows me to simultaneously verify the authenticity of their software updates, verify the authenticity of the email they send me, and encrypt my emails to them. Is there anything outside of PGP that accomplishes this?

exabrial3• 3 years ago

The most valuable feature of PGP is establishment of a long term online identity bound to a set of keys.

That is perhaps what all of these replacement schemes fail to realize.

I really wish "Login with PGP" was a thing and use a subkey for each website, with optional ability to hide the identity of a particular website in my own keychain. You know, sorta like passkeys, but I don't have to have Google/Apple/etc involved and I can actually inspect the magic behind the scenes.

tptacek18• 3 years ago

This is a perfect encapsulation of the gulf between PGP enthusiasts and cryptography engineers, because this "long term online identity" attribute is not only one of PGP's biggest misfeatures just in an implementation and design sense, but also a devastating weakness of the system for its most important intended application (exchanging messages between humans). PGP's key management system is literally the last thing you want in a messaging system.

rodlette• 3 years ago

also a devastating weakness of the system for its most important intended application (exchanging messages between humans). PGP's key management system is literally the last thing you want in a messaging system.

Strong words, but why?

exabrial3• 3 years ago

It's a devastating weakness only if you use it in a very certain manner.

woodruffw19• 3 years ago

The most valuable feature of PGP is establishment of a long term online identity bound to a set of keys.

PGP doesn't do this: PGP key has a claimant identity, but actually verifying that claimant is left to the end user. That's why the WoT and strong set were important (before they violently collapsed, revealing that they weren't load bearing after all).

Other schemes do realize this, and it's why they make tradeoffs around trusted parties (CAs in the Web PKI performing domain validation, EV for code-signing, etc.).

jcranmer3• 3 years ago

That's why the WoT and strong set were important (before they violently collapsed, revealing that they weren't load bearing after all).

I hadn't heard they violently collapsed; do you have any links where I can learn more about this?

ElectricalUnion• 3 years ago

"Login with PGP" was a thing and use a subkey for each website

How well would such sites handle PGP subkey revocation? What about PGP key revocation?

Revocation is very important if your key is compromised.

I haven't seen any really maintained pgp keyserver or service in general that didn't directly or indirectly (by user/agent mistake) fail spectacularly since https://evil32.com/ was released and contaminated the 32bit key id space.

ISV_Damocles4• 3 years ago

Is anyone else kinda hoping that GPG/PGP loses enough respect in the tech community that something fresh comes along that really solves a lot of the UX and security issues they have? (Acquiring keys, rotating keys, identifying compromised keys, and most importantly either reaches a large enough percentage of emails sent that usage of it is not in itself an immediate flag to monitor or can be implemented as a side channel not directly including the signature in the email payload itself.)

Avamander6• 3 years ago

Acquiring keys, rotating keys, identifying compromised keys, and most importantly either reaches a large enough percentage of emails sent that usage of it is not in itself an immediate flag to monitor or can be implemented as a side channel not directly including the signature in the email payload itself.

You are describing S/MIME?

ISV_Damocles4• 3 years ago

Kinda. But S/MIME has its own problems[0], mostly related to you as a recipient being unable to choose who is authorized to send you encrypted email (and so spam and malware filters don't work).

On top of that, GPG and S/MIME's support of encrypted-at-rest email is, imo, a fool's errand. Handing a payload of data to a third party that the recipient can eventually query to retrieve makes it much easier to grab a hold of and try to decrypt in the future. The same is true of SSL to an extent, but SSL traffic is much more voluminous, such that saving all of it to eventually crack and decide if there's anything worthwhile in it is unlikely.

The only real way to transfer private data between two users is to do it live with an ephemeral channel, whether that's in-person or via SSL or etc. The only value I see in GPG and friends is in verifying authenticity of the contents - signing the email - not encrypting those contents. Email has, and always will be, an open protocol, for better or worse.

[0] https://en.wikipedia.org/wiki/S/MIME#Obstacles_to_deploying_...

chimeracoder• 3 years ago

Is anyone else kinda hoping that GPG/PGP loses enough respect in the tech community that something fresh comes along that really solves a lot of the UX and security issues they have?

This already exists. It's just not a single, all-in-one tool - the answer is to use a tool that's fit for the specific purpose you're trying to accomplish (secure messaging, encrypted backups, encrypting application data, etc.)

There is not, and never will be, a modern one-size-fits-all approach because the entire industry has moved on from that model - over the last 30 years, we (collectively) have learned that it's inherently insecure to design a tool to do so many disparate things and expect people to use it correctly each way.

krageon2• 3 years ago

All of these use cases are encrypting files, some of them with a few extra steps as sauce. Stuff like whatsapp / signal is the exact UX that GPG has, fixed by instead ignoring everything that's hard (trust). The asymmetric cryptography is not fundamentally novel or interesting, and the end result of it could be applied to literally anything if they allowed you to touch your own things (which they don't). These modern solutions are build on the infantilisation of their own users, nothing else.

nextaccountic• 3 years ago

something fresh

It exists, it's called age..

Some random links

https://github.com/FiloSottile/age

https://www.reddit.com/r/crypto/comments/hr64hr/state_of_age...

https://github.com/FiloSottile/age/discussions/432

(Acquiring keys, rotating keys, identifying compromised keys, and most importantly either reaches a large enough percentage of emails..

Oh nevermind, age doesn't do any of that. Indeed, it doesn't even do email https://github.com/FiloSottile/age/issues/93

eterps• 3 years ago

'age' is really impressive, it's helped me get a better grasp on GPG.

I'm not joking, it's genuinely user-friendly, and I certainly prefer it over GPG.

Interestingly, its simplicity makes everything about GPG suddenly make more sense.

Zizizizz• 3 years ago

Age is excellent. Fast and easy for anyone to grasp

nine_k• 3 years ago

Heh.

Now send a file encrypted by age to two addressees, who don't need to know each other's decryption keys.

After that, sign an email without encrypting it; do the same with a git commit, or a Debian package.

GPG has features well beyond the simple encryption (which age does) because there are real uses for that.

justaj• 3 years ago

Has this project ever received a security audit?

berkes2• 3 years ago

I think it already has. Maybe not the underlying tech, but certainly for encrypt emails.

But I think the outcome of this is not "something fresh" but rather "giving up on the idea of encrypted emails altogether". We have far superior communication channels that are secure, easy and private today (Signal, Matrix, WhatsApp, iMessage); That problem is solved. Storing emails secure and encrypted is solved too, by providers such as protonmail, fastmail, tutanota and many others.

So what does GPG/PGP really solve still?

The one use-case that I strongly see it shine, is where mail-notifications are signed. I've only ever seen Kraken do this: Upload my GPG/PGP pub key in their web-interface, and have them sign and encrypt mails to me with that. It very much solves phishing and MITM on email-notifications (and password reset mails and such). Comes with two serious problems though: the UX on my client-end still sucks; e.g. I never managed to set-up PGP on my android client, so I cannot read their mails from my phone. "subject: Login attempt from X" body: garbled. And generation and rotation of the keys is as frustrating as ever. It certainly is not a feature for "my mom".

ISV_Damocles4• 3 years ago

I think we agree[0] on this. Email encryption isn't ever going to be a thing because of the way email itself works. But email signing would help a lot. I still don't think GPG does this very well, though, because of issues with key rotation/invalidation/etc.

[0] https://news.ycombinator.com/item?id=38557771

ekTHEN• 3 years ago

I'm using FairEmail [0] as a client on Android which supports PGP and i am quite happy with it.

[0] https://email.faircode.eu/

d0mine3• 3 years ago

Is it a coincidence that the tech you mentioned includes CIA honeypots e.g., protonmail?

gnupg looks like something that actually can keep your secrets (at rest, otherwise a less-likely-to-backdoored convenient option is Telegram).

thayne3• 3 years ago

(Signal, Matrix, WhatsApp, iMessage);

None of which are anywhere close to as ubiquitous as email. None of which are well suited to long messages. Only one of those (matrix) is federated. Only one (matrix) wasn't designed specifically for use on mobile devices. Yes, the others can be used on a desktop, but the experience isn't great.

0xDEAFBEAD13• 3 years ago

We have far superior communication channels that are secure, easy and private today (Signal, Matrix, WhatsApp, iMessage)

These are valuable tools, but they aren't usable on the command line the way gpg is. Signal doesn't help me sign an update to my software package.

Also I think the web of trust is a pretty cool concept, in theory at least. I don't know if anything outside GPG supports it.

krageon2• 3 years ago

There have been many attempts, usually formed by ignoring the inherent difficulty of creating secure communications while fundamentally being the exact same UX as GPG. It's genuinely incredibly tedious to see there is a new "alternative" and find out once again folks are over-promising and under-delivering.

zlg_codes3• 3 years ago

I think if there was interest in it there would be multiple OpenPGP implementations.

Most people don't even care about security. You can't protect people who won't care to protect themselves.

WesolyKubeczek• 3 years ago

They exist, albeit not 1:1 compatible in all aspects. That one in Thunderbird, Sequoia.

brnt• 3 years ago

When some muas announced Autocrypt support a few years ago I got excited again, but unfortunately nothing came of it. I havent been able to auto-update my key on my partner's mua, it seemed 'support' meant different things to different projects but none focused on the goal: making PGP encrypted email usable (and more secure).

Valodim4• 3 years ago

Yeah we really had a shot there.

There was a year or two where I actually began to receive autocrypt headers from random people and started encrypting with them.

Unfortunately, this momentum was completely killed by thunderbird, who decided to remove support and proceed to reimplement traditional manual email encryption :(

orthecreedence• 3 years ago

something fresh comes along that really solves a lot of the UX and security issues they have?

I'm working on this! It's called Stamp (https://stamp-protocol.github.io/) and takes a lot of the issues I've had with PGP/GPG and creates a more modern refresh. It's definitely not simple but my hope is that having sane defaults and writing good interfaces will help with this.

Unfortunately it just went through a rearchitecting and the docs are horribly out of date, but the basic concept persists. In the current version instead of having different hardcoded key types (alpha, publish, etc), there's now the concept of "admin keys" and "policies." Policies decide what keys can do what as far as managing the identity, so it's possible for instance to have a policy that gives a key god powers, or a policy that sayd "if three of these four signatures match, the entire key and policy set can be replaced" (aka, multisig recovery machanisms). Also, in the current version, "forwards" have been entirely removed and replaced by claims.

The goal is to use this as a means to act as an identity in p2p systems. My issue with p2p systems is that they always punt on identity, making it a function of your device and some randomly generated keypair. That said, Stamp can definitely be used more generally.

Right now I'm focusing on the underlying network that syncs identities between devices and also stores identities publicly, circumventing the need for keyservers and all that stuff.

lmm• 3 years ago

I'd love to see something displace GPG, particularly the "pipe to an external application" usage paradigm that's just awful in so many ways. At the same time I'm not ready to give up the only cryptosystem that we know to have actually thwarted the NSA in real-world conditions, particularly when so many of the proposed alternatives require absolute non-starters like publishing your phone number or using an unverifiable auto-updating client application.

But fundamentally there's no money in it. GPG is Like That largely because it's maintained by a grand total of one (1) guy, which is all the OSS community can afford to fund. Who's going to pay for a crypto platform, except when it's the CIA (or equivalent) sponsoring useful idiots?

Tistron2• 3 years ago

I've been using GPG to symmetrically encrypt most of my secrets, like OPT seeds and stuff like that, and then save it in some accessible places.

Just yesterday I was frustrated that gpg didn't work very well in my terminal for some reason (the barrier between entering the data and the password was weirdly permeable, i.e. sometimes some of my password ended up in the data, and more often a lot of what I pasted ended up in the password prompt).

So I found openpgp.js and made a little website where i can encrypt and decrypt my secrets.

I used that particular library because it feels safe that the things I have encrypted can be decrypted with a tool that is accessible everywhere... as long as I can remember the passwords :)

But I wonder, are the defaults for symmetric encryption in openpgp not considered safe anymore, or how should i interpret some of the other comments here?

upofadown4• 3 years ago

...are the defaults for symmetric encryption in openpgp not considered safe anymore, ...

That would be AES. The traditional OpenPGP authenticated encryption (OCFB-MDC) is secure. There has been some widespread misunderstanding, I wrote a rambling editorial against the idea of superseding the block cipher mode:

* https://articles.59.ca/doku.php?id=pgpfan:no_new_ae

0xDEAFBEAD13• 3 years ago

OPT seeds

What's that?

Tistron2• 3 years ago

Sorry, meant OTP

woodruffw19• 3 years ago

Serious question: does this matter? The PGP key ecosystem is microscopic in 2023, and is actively atrophying. Consensus among cryptographers is that PGP hasn’t reflected anything close to acceptable cryptographic design in decades, and its lack of adoption in serious tools and products reflects that.

Without a serious use case hanging in the balance, this is just OSS drama.

computerenjoyer4• 3 years ago

Yes, it does matter. PGP is by far the most common standard for signatures used in software distribution (Git tags, RPM packages, Yum repos, Deb repos, ad-hoc signature schemes, etc.), and nothing else is particularly close in terms of number of signatures verified per day. While the absolute number of verifications is a lot lower than it could be, there is still substantial inertia behind these current standards, including US government standards.

I am also aware that you are actively involved in moving ecosystems away from PGP and towards solutions in the Sigstore ecosystem, so this is definitely not news to you. I understand you want the situation to change, but for now it's disingenuous to pretend like GPG in particular doesn't have the super majority of "market" share around signatures and that drama like this wouldn't have potential impact to a lot of folks.

tptacek18• 3 years ago

How, exactly, would this (waves around at current drama) impact a lot of folks? Can you be specific about it?

woodruffw19• 3 years ago

Yes, it does matter. PGP is by far the most common standard for signatures used in software distribution

No, that would be bespoke PKIs on various proprietary OSes. PGP is miniscule compared to any of these; it's not even a rounding error. This is true even when you juice the numbers with things like git signing (which is not only ignored by 99.9% of clients but doesn't even sign the relevant software artifact for end users).

I understand you want the situation to change, but for now it's disingenuous to pretend like GPG in particular doesn't have the super majority of "market" share around signatures and that drama like this wouldn't have potential impact to a lot of folks.

If you know me, then you know I've run the numbers here[1]: even ecosystems that encouraged PGP use for decades have all the hallmarks of the signatures being completely unused. End users do not verify PGP signatures, signers do not maintain their keys; PGP's tooling encourages this behavior.

I won't deny that workflows will be broken by moving away from PGP. But those workflows are (1) a tiny, tiny minority, and (2) overwhelmingly security theater, especially now that PGP's principle feature (the WoT) is dead.

[1] https://blog.yossarian.net/2023/05/21/PGP-signatures-on-PyPI...

beeboobaa13• 3 years ago

Consensus among cryptographers is that PGP hasn’t reflected anything close to acceptable cryptographic design

Because these cryptographers haven't actually delivered anything else that's actually usable by people who just want to encrypt the bodies of their emails?

woodruffw19• 3 years ago

Cryptographers and cryptographic experts overwhelmingly agree that encrypting email is a chump's game[1]. If you want secure E2EE transit, Signal is widely recommended.

[1] https://www.latacora.com/blog/2020/02/19/stop-using-encrypte...

chlorion3• 3 years ago

Many Linux distros rely on PGP.

Most of these distros are using PGP to distribute software, often binaries that are distributed to end users.

Gentoo as an example, requires all commits to the gentoo repo to be signed by a key in the "gentoo-developers" keyring. Gentoo also provides "stage3" images which are signed by the "gentoo-release" key. Since this is a source based distro there are no binary packages, but the main ebuild repo is signed and verified upon syncing.

I know some other distros like Arch also do similar things with PGP.

Maybe you will say that this isn't actually using PGP because it's not using the "web of trust", but I don't think this is relevant, because there is much more to PGP than the WoT and those features are being used.

jandrese6• 3 years ago

This is really two different worlds. PGP for signing repos is alive and works well enough. In particular the key management is a lot easier since there's really only a small handful of entities signing things and they also control the platform. If you need to add keys (for third party repos) the process is just one more step in adding the repo in the first place so very little friction.

PGP for signing email however has been a perpetual failure. Decades later they still have not figured out a reasonable key management system, which left the community fractured and unable to scale. As you note, the Web of Trust has been a disaster for everybody except the most exceptionally paranoid who can't accept anything less. And those people talk to so few other people that they don't have the scaling issues that regular people face.

dosman332• 3 years ago

This sucks. At the same time, only experts use OpenPGP so I guess maby it's not a big deal?

I've been using PGP for decades at this point and I'm still somewhat surprised when I encounter security professionals that either can't figure out how to use PGP or just ignore it because "its too complicated, and I already have Signal". I have no beef with encrypted messenger services but it's not the same use case as PGP for email and other needs.

This also hints at a separate cultural divide. Young people only know email as that thing you need in order to setup other accounts. They use IM for the bulk of their real communication and at best consider email something they only use for work. Only old farts think of email as something they use for personal correspondence. And frankly, most of the people I interact with are younger than me so most of my communication has shifted to where the people are that use it, which is IM services.

tptacek18• 3 years ago

Experts avoid PGP like the stomach flu. It'd be interesting if you could find a single cryptography engineer of note that has spoken up for it in the last 10 years.

LtWorf9• 3 years ago

Experts like certificate authorities, which have proven themselves to be completely unreliable several times.

dosman332• 3 years ago

This is all amusing. Not that it matters, but when I said "expert" I really meant any user that understands how to use PGP. Those of us born during the construction of the pyramids know how to use it because it was the only option that existed back then, and we still have that knowledge despite other options existing. Signal and other options are great, but you can't encrypt arbitrary data with it. PGP is really a different use case these days. And the ancients that still write emails.

upofadown4• 3 years ago

There is no crisis here. Everybody can just keep using the existing standard and everything will work. It turns out that the existing stuff is actually cryptographically secure.

So far the only practical incompatibility I have seen seems to be associated with the GnuPG OCB cipher mode. Newer versions of GnuPG generate keys that show OCB compatibility. So encrypting messages/files to that particular PGP identity will result in the use of the non-backwards compatible OCB mode. That will prevent a non GPG OCB compatible from decrypting the message/file. The GnuPG project should document the issue and make it clear how one could disable the GPG OCB mode.

tptacek18• 3 years ago

You've been saying for years on Hacker News that (a) authenticated encryption is overrated, and (b) that the PGP MDC is as secure as an authenticated cipher mode.

upofadown4• 3 years ago

Specifically, I have been saying that in normal PGP usage, the PGP MDC is not relevant. Since each message is self contained (no ongoing connection), it is better to authenticate the plaintext directly with a signature. For an unsigned message an attacker can replace the whole thing. For the case of symmetrical encryption, the PGP MDC is relevant. So it depends...

More: https://articles.59.ca/doku.php?id=pgpfan:authenticated (my article)

the PGP MDC is as secure as an authenticated cipher mode.

It is. It turns out there is a class of authenticated encryption that involves first hashing the plaintext and then encrypting the plaintext and the hash. OCFB-MDC seems to be an instance of that class. That seems to defy conventional wisdom and as a result is interesting.

More: https://articles.59.ca/doku.php?id=pgpfan:mdc (my article)

upofadown4• 3 years ago

The politics here as I perceived them...

Way back, there was a rambling and expansive process to update the OpenPGP standard. Years. So eventually it was decided to do a more focused "crypto refresh" that would be restricted to just important cryptography concerns. The GnuPG program was part of this. During the process the head of the GnuPG project (Werner Koch) spent a lot of time pushing back against what he considered pointless or wrongheaded changes. Eventually things seemed to stabilize and there seemed to be a consensus and people started paying less attention. Koch was one of those people.

The process then wound up again and a bunch of stuff that Koch opposed ended up in the standards draft. Koch eventually noticed and ended up taking the position that the GnuPG project would not follow the new changes and would instead stay where they were.

I think the very best outcome here would be if the various entities would accept that the process is working to the extent of clearly showing that consensus has not been reached and can't be reached from this point. The process will have to start yet again. The root cause here seems to be that there is no real serious issue with the existing standard, so attempts to update it lack a focus. As a result there is a tendency to try to change everything.

twiss11• 3 years ago

The IETF aims for rough consensus [1][2], rather than full consensus. The OpenPGP Working Group chairs have deemed that GnuPG is "in the rough" of the rough consensus [3], and that there is sufficient consensus on the crypto refresh to publish it as an RFC. If GnuPG disagrees with that outcome, they can appeal it. That would be the normal "process" to follow, which - to my knowledge - hasn't happened yet.

As for lacking focus, I'm obviously biased as one of the authors of the document, but the charter of the crypto refresh [4] was rather narrow, and aimed at modernizing the cryptographic primitives in OpenPGP. That's what the crypto refresh focused on; e.g. see [5].

[1] https://www.rfc-editor.org/rfc/rfc8789.html

[2] https://www.rfc-editor.org/rfc/rfc7282.html

[3] https://mailarchive.ietf.org/arch/msg/openpgp/yz6EnZilyk_90j...

[4] https://datatracker.ietf.org/doc/charter-ietf-openpgp/03/

[5] https://proton.me/blog/openpgp-crypto-refresh

beeboobaa13• 3 years ago

Rough consensus doesn't have to include the people actually running the project? That sounds like a great way to publish standards that will be ignored by everyone...

Valodim4• 3 years ago

This is actually pretty accurate.

Worth noting is that the choice to move on with the rfc process was made very deliberately: there was a large thread on the mailing list to try and find a compromise. In this discussion, Werner Koch's negotiation standpoint basically required things to go 100% his way. The choices for the working group chairs ultimately boiled down to: 1. Closing down the wg with no result. 2. Moving on as a mostly functioning working group, at the cost of leaving Werner/GnuPG in the rough. 3. Reverting everything to the way Werner preferred.

None of those were great options, obviously.

Note that for option 3, the draft that is now LibrePGP and which was edited by Werner until circa 2020, had spectacularly failed to gather support and achieve consensus back then, and effectively stalled the working group for years. The LibrePGP project now claims that this draft was "the last consensus" of the working group, but at that time the reality was that Werner had gotten pretty used to just committing to master of the spec draft whatever he felt like, instead of seeking group consensus.

At the moment there doesn't seem to be a chance for the parties to come to an agreement. I'm curious to see how this develops.

jll29• 3 years ago

People should agree that if there is no consensus reachable within the group of experts, an external advisor (e.g. Bruce Schneier, Ross Anderson) should be consulted. They may not be automatically "right", but such an agreement could re-stablish focus and avoid division or, worse, ending the worthwhile group's activities.

Nothing is worse than open source people not reaching consensus and moving on, because nothing will make the enemy of privacy more happy.

throw0101b2• 3 years ago

See also 'A Critique on “A Critique on the OpenPGP Updates”':

* https://blog.pgpkeys.eu/critique-critique

Which goes over the concerns/critiques that Koch posted at:

* https://librepgp.org/

aborsy• 3 years ago

It better be quantum safe at this point. Otherwise, another update would be needed soon.

OhMeadhbh2• 3 years ago

I have a friend whose observation about many FLOSS projects is "Drama == Fork." I'm trying not to be uncharitable about Libre vs Open here, but it seems to have the aroma of drama. I chartered an IETF WG in the 2000s and there was quite a bit of drama there, though it was sort of important to allow people to be dramatic to express what they wanted the WG to work on for a while. Eventually when they realized there was consensus for something other than what they wanted us to work on, the drama started to recede.

It might be useful to wait three months and revisit LibrePGP and the OpenPGP WG and see what progress has been made.

threatofrain• 3 years ago

Related discussion.

https://news.ycombinator.com/item?id=38554943

jandrese6• 3 years ago

Wake me up when they finally offer a scalable key management system. PGP always punted on key management, and as a result has been a perpetual market flop. It always seemed to cater to people who were very willing to give up all convenience for perfect security, like can't trust keys unless they were handwritten on paper and you verified their photo ID in person before accepting them levels of paranoid. It's really frustrating for people who want a system that's good enough to always be there and providing passive benefits even if there is a theoretical case where a nation state might MITM your communications if they got there before you knew the person.

sillysaurusx• 3 years ago

And yet, without it, the Snowden leaks wouldn’t have happened. I mostly agree with you, but it’s worth pointing out that they achieved their goals; rare for a security product.

0xDEAFBEAD13• 3 years ago

Yeah, I dislike the idea of prioritizing a crypto standard that doesn't work against nation-states. Some of us like our privacy.

That said, I agree with jandrese's point about key management -- low-security key management solutions shouldn't prevent people from taking a high-security approach. Seems like the ideal situation would be if the really paranoid people end up naturally testing the low-security infrastructure as a side effect of doing their paranoia stuff. E.g. if the gpg client was set up to automatically report discrepancies between a user's personal web of trust and a presumed-authoritative keyserver.

That said, it's unclear to me why Signal wouldn't have worked for Snowden -- interested to explore details here.

throw0101c• 3 years ago

Wake me up when they finally offer a scalable key management system. PGP always punted on key management, and as a result has been a perpetual market flop.

What is the alternative KM architecture in a distributed system? Remember that for e-mail there is no central authority to handle assigning keys to individuals, unless perhaps you want Gmail and Outlook.com to handle that.

The other e-mail security system is S/MIME (which uses X.509).

jandrese6• 3 years ago

It's not hard to imagine a system where you can contact the server in the MX record for a domain over HTTPS (really just TLS) and query it for a specific email address to get the public key for that user.

Sure if someone knocks over TLS then your email encryption will be in trouble, but you will also have plenty of other problems at that point.

fl0ki2• 3 years ago

Really, we're still only hearing two sides of the story. I for one will wait for the Critique Critique Critique. Though really, ...

exabrial3• 3 years ago

I really appreciate the ending. I think that is good leadership.

dang• 3 years ago

(via https://news.ycombinator.com/item?id=38554943, but we merged most of those comments hither)

ysofunny• 3 years ago

regretably I'm too ignorant to know any better, so this is a very wild guess:

I wonder up to which extent this has to do with the Mochizuki v. Scholze and Stix disagreement?

I say this because as far as I know: elliptic curves are the state of the art in crypto,

and the IUT theory (mochizuki's) has a lot to do with elliptic curves

kazinator7• 3 years ago

It looks like a no brainer to me. If you have some program based on a standard, any non-incremental changes to the standard mean spell hard work: you have to read the updated and old spec side by side to just to determine whether something is now broken in your program, never mind what needs to be done. Of course that guy is opposed to that.

Assurances that, don't worry, it's all gonna be backward compatible, are neither here nor there, from that perspective.

charles_f• 3 years ago

I love the concept of PGP. It's too complex for non tech people to put in place ; but it saddens me to think there's an alternative reality where a google or a Microsoft has put it in place and activated it by default, and solved a solid chunk of spams, scams, and made emails secure.

This kind of governance issues make it pretty clear that won't ever happen

A Schism in the OpenPGP World

Related Stories