GnuPG 2.1.0 "modern" released [LWN.net]

GnuPG 2.1.0 "modern" released

Posted Nov 13, 2014 23:15 UTC (Thu) by epa (subscriber, #39769)
In reply to: GnuPG 2.1.0 "modern" released by raven667
Parent article: GnuPG 2.1.0 "modern" released

Widespread NSA surveillance - yes. The NSA breaking into your mbox files on disk and somehow changing messages to ones with forged signatures because of some MD5 weakness - no. Whatever the reason to drop support for the older key format, it is not because breaking PGP signatures or encryption with them is even remotely feasible today. (25 years from now it might be different, which is why these older keys should be avoided for new encryption or signing.)

A working attack against PGP, for example to forge the signature on a message, would be a sensational result. That is a long way from generating two JPEG files of random pixels which have the same MD5 hash.

to post comments

GnuPG 2.1.0 "modern" released

Posted Nov 14, 2014 0:31 UTC (Fri) by dkg (subscriber, #55359) [Link] (5 responses)

I'm not compelled at all by the argument for signature verification -- if you didn't notice whether a given signature on an e-mail was valid when you received it 15 years ago from your peer with a v3 key, it really isn't important that you find out today. And you can still read the signed message without verifications.

There are exceptions here, like people doing software archaeology, who might be interested in signatures of old tarballs (but don't have particular security requirements for their work). Archaeologists can use special tools.

So what about people who have encrypted data that really do need to be able to read their archives? Those folks are probably best off decrypting with specialized tools and re-encrypting.

Most people using GnuPG today do not have old v3 secret keys, and some of those who do have old v3 keys don't have any significant v3-encrypted data. So it's a very small group of users who have the need for v3 decryption, and those users are likely to be people with some level of crypto or software experience at this point.

So we need to weigh the options. We can give all users the rope to hang themselves with old, broken crypto, and ask our already-stretched-thin crypto developers to maintain extra code that they know is too weak to offer strong guarantees. Or we can ask the archaeologists with their legacy sigs and old-crypto-heads with legacy encrypted archives to use specialized tools for their specialized needs.

GnuPG 2.1.0 "modern" released

Posted Nov 14, 2014 8:42 UTC (Fri) by dlang (guest, #313) [Link] (2 responses)

if the signature only matters when it's received, why does it need to be cryptographicaly strong? you want to be able to validate the signature years later if it's something worth signing in the first place.

Also, having a standard practice to decrypt all your data and re-encrypt it means exposing data in it's decrypted state much more frequently than you need to. Not a good security recommendation.

GnuPG 2.1.0 "modern" released

Posted Nov 14, 2014 8:53 UTC (Fri) by epa (subscriber, #39769) [Link] (1 responses)

Yes, if you do find that the current encryption is too weak the cautious practice would be to encrypt it again - so it is now doubly encrypted and you don't need to churn through all the plaintext.

GnuPG 2.1.0 "modern" released

Posted Nov 14, 2014 18:30 UTC (Fri) by dlang (guest, #313) [Link]

that would be reasonable, except that they are dropping support for decrypting the inner layer of encryption, so it's not double encrypted, you need to decrypt it to plaintext and then encrypt it agains.

GnuPG 2.1.0 "modern" released

Posted Nov 14, 2014 8:56 UTC (Fri) by epa (subscriber, #39769) [Link] (1 responses)

What you call an archaeologist is anyone with signed or encrypted messages from twenty years ago (or often less). It is not at all unusual for correspondence to be kept that long - perhaps not all correspondence, but important messages, which are particularly those where cryptography is likely to be used.

GnuPG 2.1.0 "modern" released

Posted Nov 14, 2014 18:30 UTC (Fri) by dlang (guest, #313) [Link]

don't just think about correspondence, think about signed code dumps/patches