Is PGP a zombie technology that won’t ever die because there are organizations that have nailed their identity to it?
(For everything you think you should use PGP for please use Age - https://github.com/FiloSottile/age)
back
7 comments
Age can't authenticate when encrypting to a public key because it doesn't support signatures. So don't use it in this mode unless you know what you are doing.
Most people should just use GPG for stuff like this.
Nobody should be using GnuPG casually; if you're still using it in 2021, you should have a really clear reason for doing so. You're virtually always better off using any other well-known tool. The reasons you've provided in the past for defaulting to GnuPG --- such as its avoidance of authenticated encryption being a good data recovery mechanism --- have, to put it gently, not seemed especially informed by cryptographic best practices. It seems like more of a social cause for you than an engineering decisions. Which is fine as far as it goes, but it'd be better if you were clearer about that.
I use it indirectly with pass (passwordstore.org), which is one of the few security-related pieces of software I like. Do you have an opinion on that? I've never heard of age before, but it looks like a pass-like interface to it could be ejected in a few hours if one were so inclined.
Is the antipathy towards GPG based on it being too easy to misuse/misapply, or is it because it's broken when used properly?
I've heard nothing but good things about pass. There's also a pass that uses age now, which is I guess what I'd use if I was in the market for something like it. There's a point at which you're asking so little from your cryptosystem --- as is the case with local-only CLI password managers --- that it doesn't much matter that you're using PGP. I don't, like, recoil from .pgp.asc files! The place you really get in trouble with PGP is when you try to use it on email.
There was a link posted elsethread ( https://news.ycombinator.com/item?id=29715664 ) which reviews a lot of the issues with PGP: https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
there in fact exists a pass-like interface for age: https://github.com/FiloSottile/passage
>The reasons you've provided in the past for defaulting to GnuPG --- such as its avoidance of authenticated encryption being a good data recovery mechanism --- have, to put it gently, not seemed especially informed by cryptographic best practices.
That greatly misrepresents my position. Generally I prefer that things follow some sort of open standard. For offline capable, stateless encryption that leaves the OpenPGP standard. I have spent some time looking at it and judge it to be completely OK and worthy of use. I was even inspired to write a series of articles about it in an attempt to counteract the misinformation that I have seen:
That’s the whole point.
Cryptography tools should do one thing and do it well. Most of PGP’s problems stem from it including the kitchen sink.
If you need signatures, use minisign.
The requirement for signatures to authenticate public key encryption is inherent. OpenPGP includes it because it is for all practical purposes mandatory. It isn't some sort of useless frill.
This is public key cryptography 101 stuff...
Is calling the main player in a space a zombie technology a zombie promotional strategy for unknown upstarts? Seems like such an old pattern.
PGP (and its de facto reference implementation in GnuPG) is not the main player in this space, unless you define the space down to a point so small and idiosyncratic that it doesn't really have meaning in an broad discussion.
It's both. GnuPG has very poor UX and it's also so old and so well-known that it kills a lot of the "unknown upstarts". I think on balance GnuPG reduces the security of network communications and the appeal of a web of trust PKI because it's presented as "the main player", people try to use it, realize that the UX is garbage, and become disillusioned in the technology behind it.
Calling age an unknown upstart is a weird take.
Eh, it's pretty new, and new cryptosystems are often more likely to have vulnerabilities. It's still safer than PGP, but that's not a high bar. Hopefully over the coming years it will become more widely used and scrutinized with few vulnerabilities reported, in which case it will then be more clearly safe to rely on.
Never heard of Age here. I looked, seems like it is brand new?
I also have never heard of Age. Then again, I don’t actively keep up-to-date with the world of cryptography (other than from a PKI/X.509/TLS perspective) . As a system administrator, I only use GnuPG to check the signatures of software packages and to exchange passwords with other sysadmins.
This thread has been both interesting and educational.
Serious question: how read into work on cryptography engineering and secure messaging do you feel you are? I'm trying to get a gauge of what it means to be "brand new" for you. What cipher constructions are OK? The CAESAR finalists? The AEADs Rogaway surveys in his papers? The ones GnuPG supports?
It's been around since 2019, and has been discussed heavily on Hacker News.
age is hardly a complete replacement for GPG
A "complete replacement" for GPG would be a dumb idea to begin with.
You want a specific tool for each of these use-cases. Choose one from the list for each use case.
1. Private messaging: Signal, WhatsApp, Cwtch
2. File encryption: age
3. Encrypted backups: age + a Reed-Solomon encoder for catching flipped bits
4. Digital signatures: minisign, signify, OpenSSH signatures
The problem with GPG (and with PGP in general) is it tried to do too many things. Complexity is the enemy of security.
Has it been independently audited at all? I looked around and didn't find anything about it.
It's probably maybe fine, and of course code can change at any time, but with software focused on security, it would seem more necessary than, say, an audio player (excluding improbable situations).
Either way, It's nice to see a GPG alt written in Go.
There's also a first-class Rust implementation.
That would be Sequoia-PGP: https://sequoia-pgp.org/
No, Thomas was talking about rage. https://github.com/str4d/rage
Too late to edit my comment: I had misinterpreted “a GPG alt” as meaning a GnuPG alternative implementation of OpenPGP. Only after reading the parent and other ancestral comments did I realise that Age was the project being discussed and that it’s an alternative to OpenPGP – not just GnuPG.
Thanks for the correction. I hadn’t heard of that project.
The only thing PGP did correctly, and very well, is the concept of persistent identity. Keybase recognized this and uses PGP as the toehold, then from there, created a secure auditable chain of NACL keys. The PGP 'web of trust' and non-repudiability nature of PGP messages each failed for good reason.
This PGP-style concept of persistent identity is almost always the opposite of what you want from a secure messenger, where meta-information about who's exchanging messages with whom is often just as valuable as the message content itself. When the NSA identified Reality Winner communicating with The Intercept, they didn't so much care about what was in those messages; once the link was established, they had better ways of extracting the rest of the information they wanted than trying to defeat a cryptosystem.
> When the NSA identified Reality Winner communicating with The Intercept, they didn't so much care about what was in those messages; once the link was established, they had better ways of extracting the rest of the information they wanted than trying to defeat a cryptosystem.
Which is surely a strong argument for having keys that are standalone and portable across different communication media, rather than having them be coupled to accounts on particular services (or, worse, to personal information like an SSN or phone number).
Consider, for the age and minisign/signify use-case: https://gossamer.tools
I haven't heard of this before. How does it compare to Sigstore?
(Also, the use case here is clearly much, much narrower than for age and minisign. Which is good, assuming the problem it solves is the problem you have, but should still be noted.)
Whoa, sigstore maintainer here. I've never seen or heard of Gossamer before. It seems very similar in design!
Is there a straightforward way to use attestations to gate automatic updates?
For example, it would be nice to delay automatic updates of WordPress plugins and themes until after there is more than just the uploader's identity as a single point of failure guaranteeing that the update is genuine.
(Obviously the perfect way to do things given enough developer resources is to review all code yourself before installing manually, but it would be nice to improve situations where those resources are not available.)
Yes: https://github.com/paragonie/libgossamer/blob/master/docs/tu...
The intention was to allow security vendors to offer code reviews of open source dependencies, and you can choose which you trust. This mechanizes Linus's Law and ensures there's an audit trail with "many eyeballs".
Gossamer looks similar to Google's Trillian which is written in Go.
More specifically, Trillian is analogous to Chronicle, which is what Gossamer uses as its underlying ledger. But yeah, there's a lot of similarities. You're on the right track. :)
I'm a bit confused; if we assume that web-of-trust isn't viable, what exactly is good about how PGP does identity?
> non-repudiability nature of PGP messages
Huh? Unless you're signing it (in which case of course it's not deniable, it's a signature) it has no such nature.
Do you care to elaborate on those good reasons that the web of trust "failed"?
Age doesn't do signing.
Age doesn't do signing because PGP's signing mechanics have been one of the biggest fiascos in popular cryptography (to this day, mainstream PGP use via GnuPG doesn't produce authenticated ciphertext, due to confusion on the part of PGP's designers on the distinction between authentication and signatures). In day-to-day encrypted secure messaging, durable signatures are one of those things that sound great but are actually the opposite of what you want.
The most widespread practical use of PGP's signature capabilities are for package systems, where the actual contents of the package aren't confidential to begin with; PGP is only being used to sign. But PGP signatures are clumsy and archaic, and there are better tools to get the same capability without PGP's baggage --- notably the "signify" scheme that OpenBSD came up with and that minisign implements.
> due to confusion on the part of PGP's designers on the distinction between authentication and signatures
I'm not sure where you're heading when you think that the general populace would be any less confused about that.
Confusing the two is perilous.
https://blog.cryptographyengineering.com/2016/03/21/attack-o...
Can you reword this? I'm not sure what you're saying here. Are you asking me to go into more detail on the difference between a signature and a message authentication tag?
Fortunately, minisign does.
age doesn't replace everything PGP does, which is good, because PGP does too many things. It just replaces the use case of file encryption (which itself is arguably too general; it's perhaps best to think of age as a good fallback for encryption use cases that don't have a better domain-specific tool). See https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
This is the second link to "The PGP Problem" here. I will only post my critique of that anti-PGP rant once:
The thread on that post:
https://news.ycombinator.com/item?id=27181576
Obviously consider the source, but: I think that thread is better reading than the article.
Age isn't a complete PGP replacement (and doesn't try to be). Agree, it's a better tool for the use-cases it covers.
sequoia is better :)