GnuPG 2.1.0 "modern" released [LWN.net]

GnuPG 2.1.0 "modern" released

Posted Nov 14, 2014 8:42 UTC (Fri) by dlang (guest, #313)
In reply to: GnuPG 2.1.0 "modern" released by dkg
Parent article: GnuPG 2.1.0 "modern" released

if the signature only matters when it's received, why does it need to be cryptographicaly strong? you want to be able to validate the signature years later if it's something worth signing in the first place.

Also, having a standard practice to decrypt all your data and re-encrypt it means exposing data in it's decrypted state much more frequently than you need to. Not a good security recommendation.

to post comments

GnuPG 2.1.0 "modern" released

Posted Nov 14, 2014 8:53 UTC (Fri) by epa (subscriber, #39769) [Link] (1 responses)

Yes, if you do find that the current encryption is too weak the cautious practice would be to encrypt it again - so it is now doubly encrypted and you don't need to churn through all the plaintext.

GnuPG 2.1.0 "modern" released

Posted Nov 14, 2014 18:30 UTC (Fri) by dlang (guest, #313) [Link]

that would be reasonable, except that they are dropping support for decrypting the inner layer of encryption, so it's not double encrypted, you need to decrypt it to plaintext and then encrypt it agains.