Re: PGP Anonymous Board Idea

[Werner Koch]

On Fri,  8 Mar 2019 22:00, ab...@monksofcool.net said:

> a) We're moving ever further off topic in terms of GnuPG.

FWIW, given the low traffic on gnupg-users, I would consider this still
to on topic.


Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


signature.asc
Description: PGP signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: PGP Anonymous Board Idea

[Stefan Claas]

Am Fri, 08 Mar 2019 22:00:20 +0100
schrieb Ralph Seichter :
 
> Seriously, it strains my patience if participants in a discussion fail
> to pay attention.

O.k. understood and sorry for that i only wanted to point
out the disadvantages of centralization etc. while there
are are proper and proven methods available.

Maybe someone can tell then the OP to use Google and
search for the string "anonymous message board" and
help him then with the required anonymous PGP posting
workflow.

eod

Regards
Stefan


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: PGP Anonymous Board Idea

[Ralph Seichter]

* Stefan Claas:

> Well, mail in a "forum" like a Usenet group is there a prefered delivery
> method, thanks to mail2news gateways. [...]

a) We're moving ever further off topic in terms of GnuPG.

b) Once again, the OP wrote about "an anonymous PGP messaging board". I
happen to have created and run messaging board software, also known as
bulletin board software, since the 1980s (e.g. FidoNet, Z-Netz), and I
don't see the necessity for using mail in a MBS/BBS at all.

c) the OP proposed a centralized approach and stated "The general
process of the server would be to receive a message via HTTPS".

Seriously, it strains my patience if participants in a discussion fail
to pay attention.

-Ralph

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: PGP Anonymous Board Idea

[Stefan Claas]

Am Thu, 07 Mar 2019 16:01:05 +0100
schrieb Ralph Seichter :

> * Aleksandar Lazic:

> > I think the mixmaster approach should be still in place also when
> > you use Tor, IMHO.  
> 
> I wrote "using the Tor Network as a foundation", but in this case it
> might actually be enough. The OP presented his idea for "an anonymous
> PGP messaging board", and such a messaging board could in all
> likelihood be accessed using only the Tor Browser (I don't see a
> reason for mail in a forum application). Providing this as an onion
> service would of course also be an option.

Well, mail in a "forum" like a Usenet group is there a prefered delivery
method, thanks to mail2news gateways. Also if you host a centralized
message board on a web server it can be easily taken down, regardless
if .onion site or not. In the past many .onion sites have been shut
down. With decentralised Usenet groups or Bitmessage chans you don't
have these problems.

Regards
Stefan


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: PGP Anonymous Board Idea

[Ralph Seichter]

* Aleksandar Lazic:

> Am 06-03-2019 17:57, schrieb Ralph Seichter:
>
>> I don't see benefits over what can already be done using the
>> Tor Network as a foundation.
>
> Is Tor really as anonymous as is was in the past?

I don't know what you mean by that question.

> I think the mixmaster approach should be still in place also when you
> use Tor, IMHO.

I wrote "using the Tor Network as a foundation", but in this case it
might actually be enough. The OP presented his idea for "an anonymous
PGP messaging board", and such a messaging board could in all likelihood
be accessed using only the Tor Browser (I don't see a reason for mail in
a forum application). Providing this as an onion service would of course
also be an option.

-Ralph

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: PGP Anonymous Board Idea

[Aleksandar Lazic]

Hi.

Am 06-03-2019 17:57, schrieb Ralph Seichter:

* Farhan Khan via Gnupg-users:


Obviously this would not be the next big method of communication, but
an interesting niche idea and it seems easy to produce a 
proof-of-concept.


Not meaning to rain on your parade, but after mulling over your idea, I
don't see benefits over what can already be done using the Tor Network
as a foundation.


Is Tor really as anonymous as is was in the past?
I think the mixmaster approach should be still in place also when you 
use Tor, IMHO.



-Ralph


Aleks


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: PGP Anonymous Board Idea

[Ralph Seichter]

* Farhan Khan via Gnupg-users:

> Obviously this would not be the next big method of communication, but
> an interesting niche idea and it seems easy to produce a proof-of-concept.

Not meaning to rain on your parade, but after mulling over your idea, I
don't see benefits over what can already be done using the Tor Network
as a foundation.

-Ralph

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: PGP Anonymous Board Idea

[Stefan Claas]

Am Wed, 6 Mar 2019 00:00:31 +0100
schrieb Stefan Claas :

> You can read more about hsubs here:
> 
> http://mixnym.net/hsub.html

And to fetch hsub messages from alt.anonymous.messages:

https://github.com/crooks/aam2mail

Regards
Stefan

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: PGP Anonymous Board Idea

[Stefan Claas]

Am Tue, 5 Mar 2019 16:53:30 -0500
schrieb Farhan Khan :

> My issue with Usenet is two fold:
> A. The post metadata of the sender is preserved in Usenet.
> B. It is not easily searchable or filterable. However, the subject
> hash idea is pretty interesting.

Well, about the metadata, there is no metadata from users, when
using Mixmaster! You would install a Mixmaster client and then
use a chain of remailers, which gives you then latency, and
your posting is submitted via a mail2news gatway. The only thing
what third parties see is an encrypted PGP message (gpg hidden
recipient), posted via an exit remailer, from that chain. Additionally
people use nowadays Mixmaster in combination with Tor.

You can read more about hsubs here:

http://mixnym.net/hsub.html

Regards
Stefan

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: PGP Anonymous Board Idea

[Francesco Ariis]

Hello Farhan,

On Tue, Mar 05, 2019 at 02:39:37PM -0500, Farhan Khan via Gnupg-users wrote:
> I had an idea for an anonymous PGP messaging board system and wanted to get
> feedback on it or know if this idea has already been done.
> 
> In short, this would be an anonymous messaging system where you can post
> encrypted messages. Anyone can access the encrypted message but obviously only
> the one with the private key can decrypt it. Receiving users can filter for
> messages by their key ID to see if they have received anything. The system 
> also
> replicates data across multiple servers so you can post a message on server A
> and a user can view the message on server B.

Your idea sounds similar (but not exactly the same) to
alt.anonymous.messages [1].

[1] https://groups.google.com/forum/#!forum/alt.anonymous.messages


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: PGP Anonymous Board Idea

[Stefan Claas]

Am Tue, 5 Mar 2019 21:01:57 +0100
schrieb Stefan Claas :

> Solution 2 is use Bitmessage ...

Solution 3 is to check out ZeroNet (via Tor),
where people can also host their own message
boards etc.

Regards
Stefan

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: PGP Anonymous Board Idea

[Stefan Claas]

Am Tue, 5 Mar 2019 14:39:37 -0500
schrieb Farhan Khan via Gnupg-users :

Hi,

> Hi all,
> 
> I had an idea for an anonymous PGP messaging board system and wanted
> to get feedback on it or know if this idea has already been done.
> 
> In short, this would be an anonymous messaging system where you can
> post encrypted messages. Anyone can access the encrypted message but
> obviously only the one with the private key can decrypt it. Receiving
> users can filter for messages by their key ID to see if they have
> received anything. The system also replicates data across multiple
> servers so you can post a message on server A and a user can view the
> message on server B.

This already exists for decades ...

Simply use free Usenet Servers via Tor and post your anonymous* PGP
messages to the Usenet group alt.anonymous.messages.

*You send PGP encrypted messages via Mixmaster Remailers (via Tor) and
preferably use a hashed subject (hsub) so that the intended receiver(s)
can filter out their messages.

That is the most reliable old school method.

Solution 2 is use Bitmessage, where you can create yourself a chan
which everybody can subscribe to. Beware, once a chan is
publicty known it can be spammed easily. Bitmessage is so cool an
easy to use, via Tor, that it probably became on of the most
hated Networks in some peoples eyes. For Bitmessage there is no
need to use old stuff like PGP.

Hope this helps a bit or two.

Regards
Stefan

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

PGP Anonymous Board Idea

[Farhan Khan via Gnupg-users]

Hi all,

I had an idea for an anonymous PGP messaging board system and wanted to get
feedback on it or know if this idea has already been done.

In short, this would be an anonymous messaging system where you can post
encrypted messages. Anyone can access the encrypted message but obviously only
the one with the private key can decrypt it. Receiving users can filter for
messages by their key ID to see if they have received anything. The system also
replicates data across multiple servers so you can post a message on server A
and a user can view the message on server B.

Problems this solves:
* Increase anonyminity of the *sender*. No attributable data is stored for the
sender, such as email headers or IP addresses. The receiver can take steps to
be anonymous, such as using a different key than a primary, but ultimately the
receiver will require some form of a unique identifier.
* While you can already do this on a message board or Usenet, those systems are
not designed for this. They are not easily searchable or centralized. For
example, I cannot filter for all messages sent to 0x0123456789ABCDEF on an
online forum without a manual effort.

The general process of the server would be to receive a message via HTTPS,
determine its key ID, store it in a binary format to reduce the size and make
it searchable by the limited metadata in all encrypted messages. Finally, two or
more servers can replicate data on a periodic or in-real-time basis.

And there are obviously standard problems, such as spam, the size of the
database or a rogue server storing sender IP address data. But these are
standard problems in all such systems.

Obviously this would not be the next big method of communication, but an
interesting niche idea and it seems easy to produce a proof-of-concept.

Thoughts? I full anticipate being torn down :)

---
Farhan Khan
PGP Fingerprint: 1312 89CE 663E 1EB2 179C 1C83 C41D 2281 F8DA C0DE


signature.asc
Description: PGP signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: PGP 2.6.3 IDEA encryption

[Robert J. Hansen]

> I forgotten the password. Can most modern technology give me a
> possibility to decrypt the files?

No.


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

PGP 2.6.3 IDEA encryption

[Egon]

Hi!

I have some files which was encrypted with PGP 2.6.3. The encryption 
algorithm was IDEA.
I forgotten the password. Can most modern technology give me a 
possibility to decrypt the files?


Best regards: Egon


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: plaintext non-ssl distribution - who things this is a good idea?

[Werner Koch]

On Fri, 11 Sep 2015 00:05, r...@sixdemonbag.org said:

> (Getting an Authenticode certificate, for instance.)

Yeah, when testing the installer I always see that annoying "unknown
issuer" warning.  Thus it is probably a good idea to silence this
warning by signing the installer.  I need to see how to integrate this
into my workflow.

I also need to decide whether to use my smartcard based release signing
key but that unfortunately means that a broken smartcard will be quite
expense.  Given that it is cheap to get a faked code signing key, it
might be okay to use a standard on disk key.


Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: plaintext non-ssl distribution - who things this is a good idea?

[Bernhard Reiter]

Hi all,

On Friday 11 September 2015 at 00:15:51, Daniel Kahn Gillmor wrote:
> On Thu 2015-09-10 18:05:35 -0400, Robert J. Hansen wrote:
> >> Who else thinks someone should spring for the $10 it would take to
> >> buy and install an SSL certificate for the principal distribution
> >> point of gpg and it's signatures on the worlds most popular
> >> platform?
> >
> > There are many better ways for Werner to spend his time and money.
> >
> > (Getting an Authenticode certificate, for instance.)

like Daniel wrote: It takes more than 10€ to do this.

Gpg4win already signs the installer with an authenticode certificate
(which costs a few hundered €s). 

For services like wald or wiki.gnupg.de, experts have a trustpath
via ca.intevation.de. 

However we believe it is useful to secure some services with TLS.

> But this is a "trusted introducer" problem, and
> the cartel is the only set of trusted introducers available to people
> who don't already have GnuPG.
>
> There is already discussion about getting HTTPS set up for gpg4win.org.
> Bernhard Reiter (cc'ed here) knows about it, and other offers of help
> have already been made over on gpg4win-users...@wald.intevation.org,
> which is a better place to discuss gpg4win-specific issues.
>
> It's more an issue of getting an admin to spend a couple hours coaxing
> the website into compliance and dealing with the fallout from the SNI
> issues.

Yes. 
Background is that Gpg4win traditionally shares some services with some other 
Free Software initatives, so in comparision to a fresh setup we need to 
detangle and migrate some services. This needs some time and planning from
those that run the services. (And for some years now Gpg4win does not have
the same level of funding that GnuPG has recently aquired. So there are some
old structure to modernise.)

> Bernhard, is there anything else the rest of us can do to get this ball
> rolling?

Thomas (in cc) is one of our system administrators, he will steer the process
from our side and respond to your question (on 
gpg4win-users...@wald.intevation.org I guess, but this is up to him. :) ).

Best,
Bernhard

-- 
www.intevation.de/~bernhard (CEO)www.fsfe.org (Founding GA Member)
Intevation GmbH, Osnabrück, Germany; Amtsgericht Osnabrück, HRB 18998
Owned and run by Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner


signature.asc
Description: This is a digitally signed message part.
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: plaintext non-ssl distribution - who things this is a good idea?

[Werner Koch]

Hi,

The OP is continuing to "spam" the bug tracker
.  For the record:


OP:
  [Claims of linking FTP mirrors which are not secure and to the known
   problem of the non-https gpg4win site.]

me:
  This has nothing to do with gnupg.org.  And if you have followed the
  discussions you will have noticed that I requested to add TLS support
  for gpg4win.  Please keep this bug closed and TAKE THIS TO A MAILING
  LIST - if you want audience for this problem address it in the public
  and not on this bug tracker!  I can't do anything for you here.

OP:
  Stop closing this bug.
  I did take this to the list.
  You or whoever runs/moderates it is blocking my post.
  
  DO NOT CLOSE THIS until such time as windows users are prevented from 
  getting your security solution over totally insecure channels.
  
  This is not a game you know - it's an almost absolute certainty that your 
  careless security attitude will GET PEOPLE KILLED.
  
  Let the person who fixes the insecure distribution problem be the one who 
  closes this bug.  It is not appropriate that your ego needs to win some 
  puerile argument at the expense of other peoples safety and lives.

me:
  Nope, I have see your post.

  I asked you several times to not continue here.
  Again: PLEASE STOP THAT NOW and keep this bug closed.  



Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: plaintext non-ssl distribution - who things this is a good idea?

[Werner Koch]

On Fri, 11 Sep 2015 00:05, r...@sixdemonbag.org said:

> (Getting an Authenticode certificate, for instance.)

FWIW, the Gpg4win installer is code signed.


Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: plaintext non-ssl distribution - who things this is a good idea?

[Robert J. Hansen]

> Who else thinks someone should spring for the $10 it would take to
> buy and install an SSL certificate for the principal distribution
> point of gpg and it's signatures on the worlds most popular
> platform?

There are many better ways for Werner to spend his time and money.

(Getting an Authenticode certificate, for instance.)

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: plaintext non-ssl distribution - who things this is a good idea?

[Jerry]

On Fri, 11 Sep 2015 01:07:52 +1000, cow...@anon.im stated:

> Who else thinks someone should spring for the $10 it would take to buy and
> install an SSL certificate for the principal distribution point of gpg and
> it's signatures on the worlds most popular platform?
> 
> http://gpg4win.org/download.html
> http://files.gpg4win.org/gpg4win-2.2.6.exe
> http://files.gpg4win.org/gpg4win-2.2.6.exe.sig

I'll chip in.

-- 
Jerry

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: plaintext non-ssl distribution - who things this is a good idea?

[Daniel Kahn Gillmor]

On Thu 2015-09-10 18:05:35 -0400, Robert J. Hansen wrote:
>> Who else thinks someone should spring for the $10 it would take to
>> buy and install an SSL certificate for the principal distribution
>> point of gpg and it's signatures on the worlds most popular
>> platform?
>
> There are many better ways for Werner to spend his time and money.
>
> (Getting an Authenticode certificate, for instance.)

This is not an either/or scenario, please don't pit the one project
against another.

Both can be addressed by dealing with the CA cartel.  It's frustrating
to do this, because we all know that the CA cartel is not particularly
trustworthy as a whole.  But this is a "trusted introducer" problem, and
the cartel is the only set of trusted introducers available to people
who don't already have GnuPG.

There is already discussion about getting HTTPS set up for gpg4win.org.
Bernhard Reiter (cc'ed here) knows about it, and other offers of help
have already been made over on gpg4win-users...@wald.intevation.org,
which is a better place to discuss gpg4win-specific issues.

It's more an issue of getting an admin to spend a couple hours coaxing
the website into compliance and dealing with the fallout from the SNI
issues.

Bernhard, is there anything else the rest of us can do to get this ball
rolling?

--dkg


signature.asc
Description: PGP signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: plaintext non-ssl distribution - who things this is a good idea?

[Scott Lambdin]

und bier

On Thu, Sep 10, 2015 at 6:05 PM, Robert J. Hansen 
wrote:

> > Who else thinks someone should spring for the $10 it would take to
> > buy and install an SSL certificate for the principal distribution
> > point of gpg and it's signatures on the worlds most popular
> > platform?
>
> There are many better ways for Werner to spend his time and money.
>
> (Getting an Authenticode certificate, for instance.)
>
> ___
> Gnupg-users mailing list
> Gnupg-users@gnupg.org
> http://lists.gnupg.org/mailman/listinfo/gnupg-users
>



-- 

Eat like you give a damn.  Go vegan.
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

plaintext non-ssl distribution - who things this is a good idea?

[coward]

Who else thinks someone should spring for the $10 it would take to buy and 
install an SSL certificate for the principal distribution point of gpg and it's 
signatures on the worlds most popular platform?

http://gpg4win.org/download.html
http://files.gpg4win.org/gpg4win-2.2.6.exe
http://files.gpg4win.org/gpg4win-2.2.6.exe.sig
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: gpg wants IDEA

[Kristian Fiskerstrand]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

On 12/11/2014 07:13 AM, James Moe wrote:
 Hello, I have an older gnuPG (v1.4.6) that is apparently
 mis-configured. When signing a message, it fails with a note about
 what a bad idea IDEA is, and quits. gpg is called from an email
 program to perform security services. There is no command option to
 indicate a preferred cipher.

You shouldn't use such an old version of anything.

 gpg: protection algorithm 1 (IDEA) is not supported [GNUPG:]
 RSA_OR_IDEA gpg: the IDEA cipher plugin is not present

Then install it as a module or upgrade to at last 1.4.13 (where IDEA
was added in core)

 gpg: please see http://www.gnupg.org/faq/why-not-idea.html [^] for 
 more information gpg: skipped per...@example.com: unknown cipher
 algorithm gpg:
 W:\APPS\PMMAIL\TESTACCTS\test1_00.act\outbox.fld\nge4mh01.bod:

What does showpref on this key tell you about key preferences on that
key and your own? If you include your own key as an encrypt-to and do
not list IDEA in preferences for that it should find another common
denominator (likely 3DES)

- -- 
- 
Kristian Fiskerstrand
Blog: http://blog.sumptuouscapital.com
Twitter: @krifisk
- 
Public OpenPGP key 0xE3EDFAE3 at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3
- 
A ship is safe in harbour, but that's not what ships are for
(Will Shedd)
-BEGIN PGP SIGNATURE-

iQIcBAEBCgAGBQJUiVZsAAoJEPw7F94F4Tag1UgQAI8yHsnpn2UwUFR9cIJ/J5ng
Shg0W4hwtgid79clhmbNtSL7LTxHA8jK9ns5B/3wvusH6iaXuGTtTbpwWKRjejvR
0X5mHvx7vR651MtqwcjV6PzZU4QvWbk8fcWr7KuoFl2KWSk9Q2POpYul+RwwA74g
QDOTUAFt0HhfZ3HW3G+wZX/QNYHblIUJohCNJFwHZ2hLXzZOaPuXBogYShMw1y5q
6zP4QDLx5B3XJz7zwotq+UD1fGxhabXCyDXupd428QWQytgObKTJHi+G2O2ACJDA
vc0OYMcsQPmxGIyiP4V3h/X1ACltBAt0MPgVMcUSlKut6NKA80ue2HH2zEiy5187
m8DgjXNqouINZW2pU/QhXkvCqgVIUoLaZOU5K32i5w53NjOECt2LZIeSctK2pUJd
NpXMsfDpiiuD4qOsWE7Q5kFPMpGQ73vbm98bzkWiS2jjf5WFzY5WNA/AiuMdXtX3
4rZru2z9fTeakpqwAIYwRXntxiaIut4dJClzYUzuF2gsppMM6sm7I3fpS9/wN0Pk
f/7+t/HF13ftgJt6nCh8h7RNhQ6vzIXhcFVR/bken676QKdG1fwbM5QBzSRSp4I0
2N1KqBAmvArlizqslnd0fjecrxWNBUjmElCIZ1oc6HGaDXfLekQ9wahPswo77yGl
BEFZ5mcBicb16ESnpIy2
=btS/
-END PGP SIGNATURE-

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

gpg wants IDEA

[James Moe]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Hello,
  I have an older gnuPG (v1.4.6) that is apparently mis-configured.
When signing a message, it fails with a note about what a bad idea
IDEA is, and quits. gpg is called from an email program to perform
security services. There is no command option to indicate a preferred
cipher.

- [ command ]
gpg.exe --passphrase-fd 0 --batch --armor --no-tty --status-fd 2
- --local-user per...@example.com --output output.pgp --clearsign
input.bod 2 splat.err
- [ end ]

- [ error ]
gpg: protection algorithm 1 (IDEA) is not supported
[GNUPG:] RSA_OR_IDEA
gpg: the IDEA cipher plugin is not present
gpg: please see http://www.gnupg.org/faq/why-not-idea.html [^] for
more information
gpg: skipped per...@example.com: unknown cipher algorithm
gpg: W:\APPS\PMMAIL\TESTACCTS\test1_00.act\outbox.fld\nge4mh01.bod:
clearsign failed: unknown cipher algorithm
- [ end ]

Why would gpg feel compelled to use IDEA?
How do I convince gpg to forget about it?

- -- 
James Moe
moe dot james at sohnen-moe dot com
520.743.3936
-BEGIN PGP SIGNATURE-
Version: GnuPG v2

iEYEARECAAYFAlSJNggACgkQzTcr8Prq0ZNKvgCcCqWR7LgSHW2lk+DHE79BAJhp
zjYAni21pGKiWetthS7EN93CL/Fkk8tP
=k2Ka
-END PGP SIGNATURE-

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Implementation idea of CURVE25519 for gnupg 2.1

[Mark Schneider]

Hi,

There is GPL 3 based implementation of CURVE25519 called Pretty Curved 
Privacy (pcp1).

http://www.daemon.de/PrettyCurvedPrivacy

What do you think about using parts of the ppc1 source code to implement 
such functionality into gnupg 2.1?

http://www.daemon.de/idisk/Apps/PrettyCurvedPrivacy/pretty-curved-privacy-0.1.4.tag.gz

Myself I like this SCII Case Demo video how to use this utility:
http://asciinema.org/a/6135

Short description (from the website):
# ---
Pretty Curved Privacy (pcp1) is a commandline utility which can be used 
to encrypt files. pcp1 uses eliptc curve cryptography for encryption 
(CURVE25519 by Dan J. Bernstein). While CURVE25519 is no worldwide 
accepted standard it hasn't been compromised by the NSA - which might be 
better, depending on your point of view.


Caution: since CURVE25519 is no accepted standard, pcp1 has to be 
considered as experimental software. In fact, I wrote it just to learn 
about the curve and see how it works.


Beside some differences it works like GNUPG. So, if you already know how 
to use gpg, you'll feel almost home.

# ---

Kind regards, Mark

--
m...@it-infrastrukturen.org

http://rsync.it-infrastrukturen.org


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Implementation idea of CURVE25519 for gnupg 2.1

[Ingo Klöcker]

On Friday 15 November 2013 21:33:08 Mark Schneider wrote:
 Hi,
 
 There is GPL 3 based implementation of CURVE25519 called Pretty Curved
 Privacy (pcp1).
 http://www.daemon.de/PrettyCurvedPrivacy
 
 What do you think about using parts of the ppc1 source code to implement
 such functionality into gnupg 2.1?

FYi: Werner already implemented Ed25519 (based on Curve25519, but with a 
different signature algorithm) in GnuPG:
http://www.ietf.org/mail-archive/web/openpgp/current/msg07194.html


Regards,
Ingo


signature.asc
Description: This is a digitally signed message part.
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Mail-Followup-To (was Re: IDEA License)

[Julian H. Stacey]

 Bernstein created or not, it would seem Werner
  didn't want to be on the recipient list, which is why I brought it up
 
 The thing is that I put most mailing lists I am subscribed to on Gnu's
 message-subscribed-addresses list.  This list takes care of maintaining
 a MFT header.  Gnus will do that only if it can be sure that everyone
 agrees to this.  Thus in most cases you will see an explicit CC anyway.
 MFT works only for those folks with full support of MFT and if they
 maintain their list of subscribed addresses well.  Given that the bad
 habit of sending text+html alternative mails seems to be impossible to
 expunge [1];

Yup, horrible (as also is quoted printable, usually not needed) 

  I consider missing MFT handling a micro annoyance.
 
 I any case, I consider it a good idea to explicitly add a To: header to
 notify the addressee that this particular mail gains his attention.

Yup
 
 BTW, exmh is a nice MUA I used a long time ago and only stopped using it
 because back then a remote X connection was not really usable (and I
 didn't want to use plain mh).

Not sure what remote problems you had, but:
Even localy EXMH reply key does not work right unless one starts
from ttys with xdm  uses xauth. Starting with the ttys login xhost
+ route fails.

A person at my site regularly uses an EXMH on a slow X display
started from xdm, with AMD + NFS ~/mail/ on a faster server, works fine.

Yesterday I was just testing a new EXMH, both with DISPLAY= local laptop screen,
 my tower display, but in both cases exmh running on laptop,
with NFS+AMDsupporting ~/mail , with 493 sub dirs (`find . -type d | wc -l`)
It took minutes to start. Unusable really, I need to solve that.

I assume one could use ssh to support a tunnel for X for EXMH, but
not tried that as I dont need it.

 Shalom-Salam,
 
Werner
 
 [1] If you often send mails to Outlook users, you may want to use the
 X-message-flag header to tell them about this problem.

I run lists with 100s of people, mostly clueless MS users, running
every MUA one can dream of. Less of a dream than a nightmare.

Cheers,
Julian
-- 
Julian Stacey, BSD Unix Linux C Sys Eng Consultant, Munich http://berklix.com
 Reply below not above, like a play script.  Indent old text with  .
 Send plain text.  No quoted-printable, HTML, base64, multipart/alternative.

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA License

[Ulrich Mueller]

 On Tue, 26 Mar 2013, Julian H Stacey wrote:

 OK I added Ulrich M to cc
 He can add URL to wikipedia of expiry date of Japan IDEA paent
 if he wants, or I will if he mails it me.
 A dead patent is a good patent ;-)

IANAL, TINLA, but the term of patent in Japan seems to be 20 years and
it was filed in 1991. Concerning the exact date, here's what I had
written in my message to the FSF, about one year ago:

| To the best of my knowledge, the IDEA algorithm was covered by the
| following patents held by Ascom Tech AG, Bern, Switzerland:
|  - Europe: EP0482154 [1]
|  - U.S.:   5,214,703 [2]
|  - Japan:  JP3225440
| These patents were filed in 1991. All sources (see [3] and [4] and
| references cited therein) seem to agree that the European and the
| Japanese patent both have expired on 2011-05-16.
|
| About the U.S. patent the situation seems not so clear, as there are
| several expiry dates mentioned. The PGP FAQ [3] says it has expired on
| 2010-05-25 whereas Wikipedia [4,5] mentions 2011-05-16 and 2012-01-07.
| However, none of these dates is later than 2012-01-07. So I think it
| is safe to assume that the U.S. patent has expired, too.
|
| [1] http://register.epoline.org/espacenet/application?number=EP91908542
| [2] http://www.google.com/patents?vid=5214703
| [3] http://www.pgp.net/pgpnet/pgp-faq/#PATENT-IDEA
| [4] http://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm
| [5] 
http://en.wikipedia.org/wiki/Talk:International_Data_Encryption_Algorithm#Explanation_of_U.S._patent_expiration

Ulrich

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA License

[Julian H. Stacey]

Peter Lebbing wrote:
 On 27/03/13 12:41, Julian H. Stacey wrote:
  Thanks Ulrich for your email below, 
  It didn't make it to gnupg-users@gnupg.org  to
   http://lists.gnupg.org/pipermail/gnupg-users/2013-March/date.html#end
 
 Posts by non-subscribers are moderated (held for approval by a moderator).
 That's why it took (by comparison) so long to make it to the list. It's there
 now, also in the web archive[1].

I replied using my private copy direct from Ulrich, waited for it
to arrive at gnupg web archive, edited wikipedia to point at my
archived copy, then Ulrich's copy to gnupg list arrived on list 
web archive, so I edited wikipedia again to point to his original
rather than my copy.

 Greets,
 
 Peter.
 
 PS: By the way, your e-mail client doesn't seem to honor the Mail-Followup-To
 header, because I spotted Werner Koch in the CC list. Just so you know.

I created it, as far as I recall, from my copy direct from Ulrich, 
which had no Mail-Followup-To

Of the last 18 posts to this list, only 2 have header inc. 
Mail-Followup-To:
Both from Werner Koch.
I'm familiar with Reply-to:  Not familar with Mail-Followup-To:
What's the difference ?
Don't know if my EXMH 2.7.2 or newer I'm upgrading to elsewhere might
or not do whatever it is that presumably it should.

Cheers,
Julian
-- 
Julian Stacey, BSD Unix Linux C Sys Eng Consultant, Munich http://berklix.com
 Reply below not above, like a play script.  Indent old text with  .
 Send plain text.  No quoted-printable, HTML, base64, multipart/alternative.

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Mail-Followup-To (was Re: IDEA License)

[Peter Lebbing]

On 27/03/13 14:40, Julian H. Stacey wrote:
 I created it, as far as I recall, from my copy direct from Ulrich, 
 which had no Mail-Followup-To

Correct, the problem originated when you replied[1] to Werner's mail[2].
Werner's mail had the following header:

Mail-Followup-To: Julian H. Stacey j...@berklix.com, gnupg-users@gnupg.org

The difference between that line and a simple Reply-to-All is that Werner would
be in the recipient list with the Reply-to-All, and not with the
Mail-Followup-To. Your reply should have only had gnupg-users@gnupg.org and your
manually added CC to Ulrich as recipients, since your MUA would conclude that
you don't need to CC yourself :).

 I'm familiar with Reply-to:  Not familar with Mail-Followup-To:
 What's the difference ?

Because Reply-To didn't really work out in practice for mailing lists, DJB came
up with two non-canon mail headers to remove ambiguity from the meaning of the
Reply-To header. He describes it in [3]. Not everybody agrees with his
view/solution, though.

Whether you like the headers Bernstein created or not, it would seem Werner
didn't want to be on the recipient list, which is why I brought it up in my PS.

HTH,

Peter.

[1]http://lists.gnupg.org/pipermail/gnupg-users/2013-March/046339.html
[2]http://lists.gnupg.org/pipermail/gnupg-users/2013-March/046337.html
[3]http://cr.yp.to/proto/replyto.html

-- 
I use the GNU Privacy Guard (GnuPG) in combination with Enigmail.
You can send me encrypted mail if you want some privacy.
My key is available at http://digitalbrains.com/2012/openpgp-key-peter

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA License

[Jan Chaloupecky]

Sorry, I sent the last mail only to Hubert.


I was saying that Squeeze does not have in any of its repositories the
versions that support IDEA:

Max version of GnuPG  is 1.4.12
http://packages.debian.org/search?keywords=gnupgsearchon=namesexact=1suite=allsection=all
Max version of libgcrypt is 1.5.1
http://packages.debian.org/search?keywords=libgcrypt11searchon=namesexact=1suite=allsection=all

So in other words, I can  have IDEA support in Debian Squeeze only when I
compile myself either the extension for GPG 1 or libgcrypt for GPG 2.

Compiling and shipping IDEA means that I have to provide the sources of my
software, correct?







On Tue, Mar 26, 2013 at 7:40 AM, Jan Chaloupecky chal...@gmail.com wrote:

 I see gnupg 1.4.12-7 in Wheezy but not 1.4.13

 http://packages.debian.org/wheezy/gnupg


 --
 Jan

 On Monday, March 25, 2013 at 11:14 PM, Hubert Kario wrote:

 On Monday 25 of March 2013 21:05:02 Jan Chaloupecky wrote:

 On Monday, March 25, 2013 at 8:36 PM, Werner Koch wrote:

 On Mon, 25 Mar 2013 16:00, chal...@gmail.com 
 (mailto:chal...@gmail.comchal...@gmail.com)


 said:

 I have to use GnuPG 1.4.10 and a self compiled idea.c from here


 You better use 1.4.13.


 I have to stick to the version provided by Debian Squeeze and it's 1.4.10.
 I haven't found any back port repositories.


 that's usually a sign that the package from testing, or in this case,
 wheezy, will work fine.

 Regards,
 --
 Hubert Kario
 QBS - Quality Business Software
 02-656 Warszawa, ul. Ksawerów 30/85
 tel. +48 (22) 646-61-51, 646-74-24
 www.qbs.com.pl





-- 
Jan
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA License

[David Smith]

On 03/25/13 20:05, Jan Chaloupecky wrote:
 On Monday, March 25, 2013 at 8:36 PM, Werner Koch wrote:
 On Mon, 25 Mar 2013 16:00, chal...@gmail.com
 so the question is .. can I ship the idea shared object with my software?
 The idea.c contains the following comments. So if I understand it

 You need to provide the full source code and including that file.
 
 ok so idea is GPL.

Not quite.  Werner's implementation of IDEA (as included in GnuPG) is
copyrighted but released under the terms of the GPL, and therefore, if
you take his source code directly and copy it (or any part of it) into
your code, then you are restricted by the terms of the GPL.

The algorithm itself cannot be copyrighted, but can be patented (and
was).  The patent covered /any/ implementation (whoever coded it).
However, the patent(s) have now expired, so now anyone is free to code
their own version of the algorithm under any license they like, provided
they write their own version of the code, rather than just copying
someone else's.

Disclaimer: IANAL, you should get your own proper legal advice from a
real lawyer, etc.

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA License

[David Smith]

On 03/26/13 10:30, Jan Chaloupecky wrote:
 Sorry, I sent the last mail only to Hubert.
 
 
 I was saying that Squeeze does not have in any of its repositories the
 versions that support IDEA:
 
 Max version of GnuPG  is 1.4.12
 http://packages.debian.org/search?keywords=gnupgsearchon=namesexact=1suite=allsection=all
 Max version of libgcrypt is 1.5.1 
 http://packages.debian.org/search?keywords=libgcrypt11searchon=namesexact=1suite=allsection=all
 
 So in other words, I can  have IDEA support in Debian Squeeze only when
 I compile myself either the extension for GPG 1 or libgcrypt for GPG 2.
 
 Compiling and shipping IDEA means that I have to provide the sources of
 my software, correct?

Not necessarily.  If you write your own implementation of IDEA, you can
release it under any license you like.

If you include libgcrypt in your software, then it depends on how you
use it.  libgcrypt appears to be licensed under either GPL or LGPL[1],
so if you dynamically link against a separately-compiled libgcrypt
library, then you don't have to release your source because you can use
libgcrypt under the LGPL.

You can ship your own software and an LGPL-licensed library together
(e.g. in a tarfile), provided that the LGPL-licensed stuff is easily
separable from the proprietary stuff (i.e. in an independant library
which contains *only* LGPL code).

You do still have to include in your shipment information to state that
it includes libgcrypt licensed under the LGPL, and provide facilities
for your customers to get access to the libgcrypt source code.  If you
make any changes to the libgcrypt code to use for your application, then
you must make the source code for those changes available.

If you statically link libgcrypt into your software (i.e. compile it in
to the binary), then it is no longer easily separable from the
proprietary code, so you must release the source code to your software,
and furthermore, you cannot prevent anyone copying, modifying and
distributing your software and/or source code.

Again, IANAL, get your own professional legal advice, etc...

[1] http://directory.fsf.org/wiki/Libgcrypt

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA License

[Werner Koch]

On Tue, 26 Mar 2013 01:38, j...@berklix.com said:

 So to wikipedia, after Japan I appended expired 2011-05-16 
 I could edit in an href'd citation to wikipedia, if URL known ?

I don't know; the dates are by Ulrich Müller ulm at gentoo.org


Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA License

[Julian H. Stacey]

  https://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm#Availability


 From: Werner Koch w...@gnupg.org 
Werner Koch wrote:
 On Tue, 26 Mar 2013 01:38, j...@berklix.com said:
 
  So to wikipedia, after Japan I appended expired 2011-05-16 
  I could edit in an href'd citation to wikipedia, if URL known ?
 
 I don't know; the dates are by Ulrich Müller ulm at gentoo.org

OK I added Ulrich M to cc
He can add URL to wikipedia of expiry date of Japan IDEA paent
if he wants, or I will if he mails it me.
A dead patent is a good patent ;-)

Cheers,
Julian
-- 
Julian Stacey, BSD Unix Linux C Sys Eng Consultant, Munich http://berklix.com
 Reply below not above, like a play script.  Indent old text with  .
 Send plain text.  No quoted-printable, HTML, base64, multipart/alternative.

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

IDEA License

[Jan Chaloupecky]

Hi,
is the IDEA algorithm licensed? Under which conditions am I allowed to use
the idea extension in a commercial product?


cheers

-- 
Jan
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA License

[Werner Koch]

On Mon, 25 Mar 2013 13:46, chal...@gmail.com said:

 is the IDEA algorithm licensed? Under which conditions am I allowed to use
 the idea extension in a commercial product?

I assume your question is: Is the IDEA algorithm patented?

It was patented and this was one or the main reasons to develop GnuPG as
the free PGP replacement.

Meanwhile the patent expired:

 * Patents on IDEA have expired:
 *   Europe: EP0482154 on 2011-05-16,
 *   Japan:  JP3225440 on 2011-05-16,
 *   U.S.:   5,214,703 on 2012-01-07.

Thus if you have to decrypt old data you may now use a decent GnuPG
versions to do that (1.4.13 or 2.x along an appropriate Libgcrypt
version).


Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA License

[Julian H. Stacey]

 Hi,
 is the IDEA algorithm licensed?

Wrong question !  Try: copyright?   patented?   

 Under which conditions am I allowed to use
 the idea extension in a commercial product?

https://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm#Availability

Cheers,
Julian
-- 
Julian Stacey, BSD Unix Linux C Sys Eng Consultant, Munich http://berklix.com
 Reply below not above, like a play script.  Indent old text with  .
 Send plain text.  No quoted-printable, HTML, base64, multipart/alternative.

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA License

[Doug Barton]

On 3/25/2013 12:01 PM, Peter Lebbing wrote:

On 25/03/13 14:22, Julian H. Stacey wrote:

Hi,
is the IDEA algorithm licensed?


Wrong question !  Try: copyright?   patented?   


Copyright on an algorithm? Don't you mean a particular implementation of the
algorithm? IOW: Wrong question, next try?


He clarified that in a subsequent post. The usual netiquette is to read 
the entire thread before responding to any individual post.


Doug


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA License

[Peter Lebbing]

On 25/03/13 20:06, Doug Barton wrote:
 He clarified that in a subsequent post. The usual netiquette is to read the
 entire thread before responding to any individual post.

I see only one post by Julian H Stacey, and the web archive[1] agrees, so maybe
you got a private mail? (But why?)

Anyway, I was slightly irked by his way of phrasing. All in all, I prefer my
post to his, but I wouldn't normally phrase a post like that. So it indeed was
somewhat about etiquette.

Peter.

[1]http://lists.gnupg.org/pipermail/gnupg-users/2013-March/thread.html

-- 
I use the GNU Privacy Guard (GnuPG) in combination with Enigmail.
You can send me encrypted mail if you want some privacy.
My key is available at http://digitalbrains.com/2012/openpgp-key-peter

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA License

[Werner Koch]

On Mon, 25 Mar 2013 16:00, chal...@gmail.com said:

 I have to use GnuPG 1.4.10 and a self compiled idea.c  from here

You better use 1.4.13.

 ftp://ftp.uwsg.indiana.edu/linux/gentoo/distfiles/idea.c.gz

 so the question is .. can I ship the idea shared object with my software?
 The idea.c contains the following comments. So if I understand it

You need to provide the full source code and including that file.

 correctly, I just have to add this somewhere in the documentation of my
 software.

You have to follow the conditions of the GPL; see the file COPYING in
the GnuPG distribution.


Salam-Shalom,

   Werner


-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

(OT) Re: IDEA License

[Peter Lebbing]

On 25/03/13 20:49, Doug Barton wrote:
 Thus endeth the lesson,

Yeah, after I wrote my reply, I wondered if it was even wise to fight fire with
fire. So the lesson didn't come entirely unexpected.

I respectfully disagree that the mail didn't warrant a reply at all. One could
also simply point out that it wasn't very friendly to use 2-word phrases to
point someone to a mistake. And make the same mistake subsequently ;P.

Anyway, on to something fun...

Peter.

-- 
I use the GNU Privacy Guard (GnuPG) in combination with Enigmail.
You can send me encrypted mail if you want some privacy.
My key is available at http://digitalbrains.com/2012/openpgp-key-peter

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA License

[Julian H. Stacey]

Hi gnupg-users@gnupg.org
cc Werner K.

I wrote:

 https://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm#Availability


Werner posted:

 Meanwhile the patent expired:
  * Patents on IDEA have expired:
  *   Europe: EP0482154 on 2011-05-16,
  *   Japan:  JP3225440 on 2011-05-16,
  *   U.S.:   5,214,703 on 2012-01-07.

So to wikipedia, after Japan I appended expired 2011-05-16 
I could edit in an href'd citation to wikipedia, if URL known ?

Cheers,
Julian
-- 
Julian Stacey, BSD Unix Linux C Sys Eng Consultant, Munich http://berklix.com
 Reply below not above, like a play script.  Indent old text with  .
 Send plain text.  No quoted-printable, HTML, base64, multipart/alternative.

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

GPG2 and IDEA

[Jan Chaloupecky]

Hi,
the short question is how do I enable the IDEA support in GPG2.

I tried following this article:
http://www.kfwebs.net/articles/article/42/GnuPG-2.0---IDEA-support

but even the patching of the libcrypt source files does not work. Here's
what I did:


 wget ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-1.2.4.tar.bz2
 tar jxvf libgcrypt-1.2.4.tar.bz2
 wget http://www.kfwebs.com/libgcrypt-1.2.4-idea.diff.bz2
 bunzip2 libgcrypt-1.2.4-idea.diff.bz2
 patch --dry-run   libgcrypt-1.2.4-idea.diff

The patch command gives me a lot of FAILED messages:


 patching file cipher.c
 Hunk #1 FAILED at 72.
 1 out of 1 hunk FAILED -- saving rejects to file cipher.c.rej
 patching file idea.c
 patching file Makefile.am
 Hunk #1 FAILED at 63.
 1 out of 1 hunk FAILED -- saving rejects to file Makefile.am.rej
 patching file configure.ac
 Hunk #1 FAILED at 110.
 Hunk #2 FAILED at 715.
 2 out of 2 hunks FAILED -- saving rejects to file configure.ac.rej
 patching file cipher.h
 Hunk #1 FAILED at 58.
 1 out of 1 hunk FAILED -- saving rejects to file cipher.h.rej
 patching file basic.c
 Hunk #1 FAILED at 542.
 1 out of 1 hunk FAILED -- saving rejects to file basic.c.rej


what am I doing wrong?

cheers


-- 
Jan
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: GPG2 and IDEA

[Werner Koch]

On Tue, 19 Mar 2013 11:57, chal...@gmail.com said:

 wget ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-1.2.4.tar.bz2

That is a pretty old version.  You should move to a decent one; at least
1.4.x or better the latest 1.5.1.

There is no IDEA support there, regular support is only available in the
forthcoming 1.6 (you might be able to backport from master to 1.5.1)


Salam-Shalom,

   Werner


-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: GPG2 and IDEA

[Werner Koch]

On Tue, 19 Mar 2013 16:56, chal...@gmail.com said:
 I actually managed to compile just the module and load it dynamically in
 gpg:

I doubt that.  Looking at the 2.0 branch I see this in gpg.c:

  case oLoadExtension:
/* Dummy so that gpg 1.4 conf files can work. Should
   eventually be removed.  */
break;

Sure that you are not using 1.4?  In this case 1.4.13 already includes
idea support.


Shalom-Salam,

   Werner


-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: GPG2 and IDEA

[Jan Chaloupecky]

Sorry, I meant that I was able to run it in gpg 1.4 not 2
this is ok for me.


-- 
Jan


On Tuesday, March 19, 2013 at 11:59 PM, Werner Koch wrote:

 On Tue, 19 Mar 2013 16:56, chal...@gmail.com (mailto:chal...@gmail.com) said:
  I actually managed to compile just the module and load it dynamically in
  gpg:
  
 
 
 I doubt that. Looking at the 2.0 branch I see this in gpg.c:
 
 case oLoadExtension:
 /* Dummy so that gpg 1.4 conf files can work. Should
 eventually be removed. */
 break;
 
 Sure that you are not using 1.4? In this case 1.4.13 already includes
 idea support.
 
 
 Shalom-Salam,
 
 Werner
 
 
 -- 
 Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.
 
 


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Can version 1.4.11 be configured to use IDEA?

[Richard]

All right, thanks! :)

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Can version 1.4.11 be configured to use IDEA?

[Richard]

Hello,

On Tue, Jul 19, 2011 at 03:57, Robert J. Hansen r...@sixdemonbag.org wrote:
 Is there some particular reason why you send messages in an obfuscated format?

how is that working anyway? Apparently GPG automatically decrypted
those messages for me. How were they generated? What is that? :)

Thanks,

Richard

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Can version 1.4.11 be configured to use IDEA?

[Jerome Baum]

 how is that working anyway? Apparently GPG automatically decrypted
 those messages for me. How were they generated? What is that? :)

:compressed packet: algo=1
:onepass_sig packet: keyid 1E3B6A9CD77480F6
version 3, sigclass 0x00, digest 2, pubkey 1, last=1
:literal data packet:
mode b (62), created 1311035908, name=gpguser3.txt,
raw data: 1884 bytes
:signature packet: algo 1, keyid 1E3B6A9CD77480F6
version 3, created 1311035908, md5len 5, sigclass 0x00
digest algo 2, begin of digest 1b 52
data: [1019 bits]

Looks like this is what you get from a simple armor command.

-- 
Jerome Baum

Hessenweg 222
48432 Rheine
GERMANY

tel +49-1578-8434336
email jer...@jeromebaum.com
web www.jeromebaum.com
--
PGP: A0E4 B2D4 94E6 20EE 85BA E45B 63E4 2BD8 C58C 753A
PGP: 2C23 EBFF DF1A 840D 2351 F5F5 F25B A03F 2152 36DA
--
Q: Why is this email five sentences or less?
A: http://five.sentenc.es

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Can version 1.4.11 be configured to use IDEA?

[Johan Wevers]

On 20-07-2011 12:31, Richard wrote:

 how is that working anyway? Apparently GPG automatically decrypted
 those messages for me. How were they generated? What is that? :)

They were only signed, but not in plaintext but Base 64 encoded.

-- 
Met vriendelijke groet,

Johan Wevers


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Can version 1.4.11 be configured to use IDEA?

[Jay Litwyn]

-BEGIN PGP SIGNED MESSAGE-
 
On 2011-07-20 4:31 AM, Richard wrote:
 Hello,

 On Tue, Jul 19, 2011 at 03:57, Robert J. Hansen
 r...@sixdemonbag.org wrote:
 Is there some particular reason why you send messages in an
 obfuscated format?

 how is that working anyway? Apparently GPG automatically decrypted
 those messages for me. How were they generated? What is that? :)

gpg --sign message.txt
notepad message.txt.asc
Clear message answer.
Cut and paste message.txt.asc into answer of message.

It is a compressed, ascii-armoured, and signed message.
It handles long lines without pgp/mime (which currently
doesn't work for me), and it survives whitespace corruption
such as what you might get from cutting and pasting a
message from an archive. gpg -sa message.txt does the
same thing. Notice the omitted Teh that would make it a
- --clearsign .


 Thanks,

 Richard


The soldier who survived mustard gas and
pepper spray is now a seasoned veteran.
-BEGIN PGP SIGNATURE-
Version: GnuPG v2.0.17 (MingW32)
Comment: http://ecn.ab.ca/~brewhaha/gpg/Keyprint_Biometric.mp3.pgp
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
 
iQCVAwUBTidMIB47apzXdID2AQGXXgQApO37rCwoMqDBLaEKkItg1a+Jig4kBl3E
84/60lhu1d/txujQ+hm9uqbm1i1eTQ3UIktkgRojr6zB2J32Cdsef74UgK0758di
YUho5JeC6Gq/PFV0KN84RWVyujgbOe9I2GgmISUcVqLrWiCAa0/K2qZ5mGG3feM/
ChdOsRfHSpU=
=ibHH
-END PGP SIGNATURE-


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Can version 1.4.11 be configured to use IDEA?

[Jay Litwyn]

Looks like the answer to my question iz: Not legally. I was thinking
that IDEA was more than ten years old, which I thot meant that the
patent on it was expired. Silly me, though, looks like patent law
changed for about seven more years of length. So, while I'm waiting for
six months or whatever, I might az well change the password (and
encryption algo) on my private key with gpg 1.2.2., and then migrate to
1.4.11.

Hopefully, I can use the same key with PDF. Kuz, if not, then I *do*
know how to convert PDF keys (S/MIME) to PGP format, and I want only one
key for everything. I revoked a subkey before I realized that people
need it to encrypt messages to me.
___
http://ecn.ab.ca/~brewhaha/

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Can version 1.4.11 be configured to use IDEA?

[Jay Litwyn]

-BEGIN PGP SIGNED MESSAGE-
 
To make a long story short.
I created a key with jenuine pgp 10.
I exported it with IDEA.
I made gpg 1.2.2 work with IDEA.
Making gpg 1.4.11 work with IDEA failed.
I changed my pass-phrase using --crypt-algo CAST5 with 1.2.2.
Now, enigmail works, so I am one happy camper.
-BEGIN PGP SIGNATURE-
Version: GnuPG v2.0.17 (MingW32)
Comment: http://ecn.ab.ca/~brewhaha/gpg/Keyprint_Biometric.mp3.pgp
Comment: http://ecn.ab.ca/~brewhaha/gpg/Keyprint_Biometric.mp3.pgp
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
 
iQCVAwUBTiVGbB47apzXdID2AQHQJAP+Mqmqu/58FHIT5os2t+B29Lgz+KFI8ctz
i2j/iB3GCwZT7GNEhj8QF1scc3nO/gPdkGChAReLpuX6Oe0OJiOSl5Yl0Q1jmP0R
zfcHkQeiRRhR4ZigjEkWpVMOWVQ0fZc/jeDlG5sGshS56Hdjh19iaNmi8u/PVne6
BTehLUUEqlg=
=mqIE
-END PGP SIGNATURE-


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Can version 1.4.11 be configured to use IDEA?

[Jay Litwyn]

-BEGIN PGP MESSAGE-
Version: GnuPG v1.2.2 (MingW32)
Comment: http://ecn.ab.ca/~brewhaha/gpg/Keyprint_Biometric.mp3.pgp

owGbwMvMwMQoZ50153pJwzfGtYyTk7jTC9JLi1OL9EoqSvxU+rL8ixRS8hU8FfJS
U1MUSvIVgHIKZalFxZn5eQqGeiZ6lvZAyeLEcoVEhdzU4uLE9FSQqpKMVIXUtLTU
5BIgM7EEolKhPDMnB2xAZkpqol5KTo6eQnC+QlpikQ7QjIzEMoWk1NQ8hdK8xKQc
sCnJ+XlpmemlRalg/YaGMPvB2hVCMjKLFYAoUSEtMy9VoTw1Jzk/NxXZFSB/FCvk
pykEuAdA3JEINCs3M70osSQzLx2kJDUvMz03MTNHIS2/COzq4ozU1CKFgvxyIAnU
CXRCGVBNal5yqkJiXopCWk5qRWZSZk5mSaWCRnJ+aUEOMFjKM0sywJrTEmEehpub
kp9arJCXX6KQm5+SmVYJd15xfmlRcqqmFS9XtKdfmKOPp4uCs2eAh2uQgr+fQkCQ
Z5hjiKuCt2ukXmwnw1RmVgZQXMAjimnxMuZ/VhNaJq84N6P4ys3oaUd19W1PzHYT
aTYWif+9rTY/+O2B5+/2GH5oLWqaJtyx6MBB/onbDT7uNv+/3/rjkff35gdciMsI
TZDm43J3EjHfZFujczfTLKJwy7fQTwkx396p1rP5VV/jZa/brnX6wqKN89l9xOLY
Fj2a1p3v9ZvJLXRNbcyVa5+zAQ==
=arjT
-END PGP MESSAGE-


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Can version 1.4.11 be configured to use IDEA?

[Johan Wevers]

On 18-07-2011 21:57, Jay Litwyn wrote:

 Or do I need to use version 1.4.9?

I have no problem using idea.dll with 1.4.11. I didn't need to change
anything to the config file, just the line

load-extension c:\program files\gnu\gnupg\idea.dll

with the correct path to idea.dll of course, and including the .dll
extension.

-- 
Met vriendelijke groet,

Johan Wevers


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Can version 1.4.11 be configured to use IDEA?

[MFPA]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Hi


On Monday 18 July 2011 at 8:57:35 PM, in
mid:4e24902f.5030...@freenet.edmonton.ab.ca, Jay Litwyn wrote:



 Or do I need to use version 1.4.9? I saw a message to the effect
 that 1.4.9 will use idea.dll. So far, I hav been unable to configure
 1.4.11 to use idea.


Including the following line in my gpg.conf file works here:-

  load-extension [PATH]\idea.dll

Replace [PATH] with the actual path to your idea.dll file.


I am using v1.4.11 under Windows XP. I don't normally use idea.dll but
just tried and including that line still works (insofar as it causes
IDEA to appear in the cipher list when I type gpg --version).

- --
Best regards

MFPAmailto:expires2...@ymail.com

A bird in the hand makes it awfully hard to blow your nose
-BEGIN PGP SIGNATURE-

iQE7BAEBCgClBQJOJKK6nhSAAEAAVXNpZ25pbmdfa2V5X0lEIHNpZ25pbmdf
a2V5X0ZpbmdlcnByaW50IEAgIE1hc3Rlcl9rZXlfRmluZ2VycHJpbnQgQThBOTBC
OEVBRDBDNkU2OSBCQTIzOUI0NjgxRjFFRjk1MThFNkJENDY0NDdFQ0EwMyBAIEJB
MjM5QjQ2ODFGMUVGOTUxOEU2QkQ0NjQ0N0VDQTAzAAoJEKipC46tDG5pipMEAJzj
8ct8grtXtubXn8SDnJzVl0Os9GSJUJllKC7nGBGcoxbiiyCxymKkxk080+U8INE5
YLzGMt6mN/M8GUTgW+PXwVoV56hlbbzt+kRXw9BKyneM562F49BvCS5A3xIh4IDX
c8y36YZLuiR0BTZRKhBMRkFpiTwN29pXIc9Ov4Fa
=nCdA
-END PGP SIGNATURE-


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Can version 1.4.11 be configured to use IDEA?

[Johan Wevers]

On 18-07-2011 23:45, Jay Litwyn wrote:

 I tried that. Because I sometimes use gpg from the command line, my 
 configuration line reads:
 load-extension c:\gnupg\idea.dll
 It doesn't work, even if I move gpg.conf to my pub directory: I still get 
 invalid cipher from trying to decrypt my own private key. And like, hey!, 
 to the other guy who replied, no point is in a signature with more than 128 
 bits, either: SHA512 is incompatible with gpg 1.2.2: Computer's can't even 
 count to 2^64 in less than 2^32 seconds.

On Windows you have to put gpg.conf somewhere in your homedir, it
depends on the Windows version where that exactly is. gpg --version
shows you which gpg.conf it is using.

-- 
Met vriendelijke groet,

Johan Wevers


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Can version 1.4.11 be configured to use IDEA?

[Jay Litwyn]

-BEGIN PGP MESSAGE-
Version: GnuPG v1.2.2 (MingW32)
Comment: http://ecn.ab.ca/~brewhaha/gpg/Keyprint_Biometric.mp3.pgp

owGdVU2IHEUUTrLGnyUDOQlGlGcSSJb09Ez3TDabVhZndyaTibM7w86uy0oS6Omu
6S7T3dVUV2+nIWggsuIhIAkiUS/ecvEigoIgiAej3uLBnBQEDzEgXowGc/BV9f5E
RaIOQ/9UvffVe9/73uvXS2Pbdmx/8ukX3/lGnL+9/b2HouEuL/bShPCaLs6K+f3X
H+hFYFYNo1w9UjamoG4ZNejPaXCC+XYEy2SV8AQyzgSxSuPTgNbGlLSVPmDWrPph
tLVz6FKR5dGWJf6noQOCU+KC8G2hwwxxbDwaVxMWEkFDkoB8x4hgxFmIZgQcFoZ2
5EJAI6IpkDDHxWhEvZTbgrJIbQEntptYyiBgtlsmZwWJErntWCe9KI29k9Qltu4G
QRGKAJeRJDogIGP8jAaYWQR0hNGEbFUFoctjQDB5YpwOwaWcOILx3IKOwkgEDQLw
iIC9NFq1A+qCQ2Of8L3r8fOcRp5EcInD81hIJJZFEHO6agsCZ0iuK6SGyvAM0cAn
+VOadJHJM7xw8NIcMp9hinGA7GkQMYgZjQTQBGgENiTUi2yRcqLAMip8TIITyTPW
x5yCIRUJpkglngWD443Dhll4I78x0jgMSOEnyTd0UzcLLmdxOxWEH0jAsSVZiiaH
pXg6BmmenqzLEAKSJMVp5umaCQlB6txEL+ouRbJMI5dlCeQsBd9GftEZgbdolhLI
MDoi4dCKg48rSLkGVEgQl8QEMQErKqnZAJR6lFUufKWwgJy1HRHkmJ+u0imX140k
TOJvhJH51PG3AqCKzjTBihVxl8al88F2lPbbEwUnpfFZFuecer6Ag7MT2CjVGhzj
hMCAjURmYwTHkBpX6VKDTuQg1KKPuDFnHrdDKWdUuWK6MTPodZcWW90VmO/BcmNh
oTG/uLLhgP+RBE7WgTWQXSDjlqdkJJBIkkWOJCXYVkMsk6IKz0fROIQLm8pSRS6V
4SAZA0IUdyOK1Z7t9Vc6820YMY7com0g61UaP464FjZNRTVNaXyQxjHjArvWDjzG
MfJQ9lk/HaJ6LVgYNDR5KbeK20CDVrct35pyB5+RNNUU2DXNFi7Vmi00mm0MFnFU
zHR7y8c6g+MaNOQqXoyjprqbhyc1WFzuyV2Myk58C+aa6ILqNfCsTr811zQmq2oB
jWVtwpijEDFZC5aUsuWr7JgXOn28dDszMsM/F9bUq7pxBF9jr54hYaZu6NWJ0nhA
h17RtIZe1yf/Xnqcd/crfZc6OIQItPvd1dohC9rzS/J5U7Q1QPIDnAQcnvGFiK2K
ZF1n3KsEhWtS8eJA90UYTP+DMKxNUahlVISDfegRpZe/iEOJS/VYcq/mNueNGpoC
YsJDKmTJhzmGl92ji1mr0mROGqJZok4YECGwZZJKL4sIrzRinFFOMZebtrD/i4pQ
K0o1W4L5H1KR5nOtbrfTwLmHHwxY/22uSp+NFyWb+0tL3WtTdW19chbrZv3fSQ4j
x2dTcvjatjfGdm6TX9nNb/COxxfGfn/wlS/Xrnx14lK9fO6tXQ9f/e2Td1uPXj9x
bc/unS99/OrdU5+fu7G2Z/fRRyaev8mCQT79/tjVt3/6ds+l+nPVO7dr+2/tm3/z
3Iqz9umSe/fXHe9dfOy7q7cufrj8/Y1Wf+fazxeub9+7m104//WhuSfq+65d/qU9
9XLjsx+1L+5cOfXsRfrR5Q9u/vAH
=f5VZ
-END PGP MESSAGE-


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Can version 1.4.11 be configured to use IDEA?

[Robert J. Hansen]

Is there some particular reason why you send messages in an obfuscated format?

That said: on Windows you can usually find it in %APPDIR%\Roaming\GnuPG, at 
least for Win 7.  Otherwise, I'd suggest familiarizing yourself with Windows' 
facilities to search for a file by filename, and search through %APPDIR% 
looking for gpg.conf.

Also, you really ought consider upgrading.  1.2.2 is really, really old.  Many 
bugfixes have come and gone since then.


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA Status?

[MFPA]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Hi


On Wednesday 23 June 2010 at 5:35:19 AM, in
mid:5154913f-ea7e-44ed-a67b-20c5e2998...@jabberwocky.com, David Shaw
wrote:




 So it's still patented,
[...]

 It's not even clear where you could get a license if
 you really had to use IDEA.
[...]

I understood that for non-commercial use, IDEA was freely available
for use and that licences were only needed for commercial use in the
countries where it is patented.


- --
Best regards

MFPAmailto:expires2...@ymail.com

Teamwork is essential - it allows you to blame someone else
-BEGIN PGP SIGNATURE-

iQCVAwUBTCJAj6ipC46tDG5pAQpfzgP+Jm6rPhwmB70GBUJyWY0aKnjaAZ28CaRj
7wOuZl4WM5yMk6io9udmxS0JuJaQlSk8XKkN+OGgRdXqIOebgniNygZWoOyACuii
2rn0ciGS7anLp3hZ3HMY9c3KzOUZ/0X3YsjU6dWz+E6fJFogLYseRAyHL40z4owB
xSewfqd3EC8=
=lx0n
-END PGP SIGNATURE-


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA Status?

[Robert J. Hansen]

On 6/23/10 1:12 PM, MFPA wrote:
 I understood that for non-commercial use, IDEA was freely available
 for use and that licences were only needed for commercial use in the
 countries where it is patented.

Sure, but that makes it incompatible with the GPL -- and that
incompatibility puts some severe restrictions on redistribution.  There
are some (arguable) workarounds around it, but by and large it's best to
avoid the entire can of worms.

We don't need IDEA, so why wrestle with the Patent Monster?

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA Status?

[Dan Mahoney, System Admin]

On Tue, 22 Jun 2010, Robert J. Hansen wrote:


On 6/22/10 10:09 PM, Dan Mahoney, System Admin wrote:

Is this very old and it's now supported?  Or is it still not in for some
other reason (either oversight, legal, or other).


By modern standards, IDEA is not considered a promising cipher.  There
are some very good theoretical attacks against it.  Between the varying
patent expiration dates (2011 or so in some countries, IIRC) and the
thin safety margin, the GnuPG community has generally decided IDEA is
not a priority for inclusion.


Could the FAQ be updated then, assuming you speak with some authority?

-Dan


--

Ca. Tas. Tro. Phy.

-John Smedley, March 28th 1998, 3AM

Dan Mahoney
Techie,  Sysadmin,  WebGeek
Gushi on efnet/undernet IRC
ICQ: 13735144   AIM: LarpGM
Site:  http://www.gushi.org
---


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA Status?

[David Shaw]

On Jun 22, 2010, at 10:09 PM, Dan Mahoney, System Admin wrote:

 The FAQ for IDEA states that The official GnuPG distribution does not 
 contain IDEA due to a patent restriction. The patent does not expire before 
 2007 so don't expect official support before then.
 
 (http://gnupg.org/documentation/faqs.en.html#q3.3)
 
 Is this very old and it's now supported?  Or is it still not in for some 
 other reason (either oversight, legal, or other).

I'm not sure about the 2007 patent expiration - I recall it being right around 
now, actually (2010-2011).

In any event, it's mostly not supported.  IDEA in OpenPGP is a funny thing - it 
sort of missed its useful window because of the patent stuff.  PGP 2.x used it, 
but when things went to OpenPGP, 3DES was used instead, and IDEA was downgraded 
to a SHOULD implement in the first OpenPGP spec, and then downgraded further to 
a MAY implement in the revised spec.

Time moved on, and better ciphers became available, so these days even though 
the patent is expiring, there isn't really a use for IDEA outside of 
interoperating with users of PGP 2.x.  I'd be surprised to see much PGP 2.x 
usage these days.  OpenPGP even explicitly rejects making new PGP 2.x-style 
keys.

David


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA Status?

[Robert J. Hansen]

On 6/22/10 10:30 PM, Dan Mahoney, System Admin wrote:
 Could the FAQ be updated then, assuming you speak with some authority?

I am correct, but I am not authoritative.  I'm not one of the GnuPG
developers, so I have no authority to make declarations on behalf of GnuPG.


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA Status?

[Robert J. Hansen]

On 6/22/10 10:39 PM, David Shaw wrote:
 I'm not sure about the 2007 patent expiration - I recall it being
 right around now, actually (2010-2011).

A little digging around revealed the United States patent expiration:
January 7, 2012.

I am not a patent attorney, I don't pretend to be an authoritative
source on patent law.  All we can say definitively is the original
patent expires January 7, 2012: subsequent patents may have extended
this date.

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA Status?

[David Shaw]

On Jun 22, 2010, at 11:25 PM, Robert J. Hansen wrote:

 On 6/22/10 10:39 PM, David Shaw wrote:
 I'm not sure about the 2007 patent expiration - I recall it being
 right around now, actually (2010-2011).
 
 A little digging around revealed the United States patent expiration:
 January 7, 2012.
 
 I am not a patent attorney, I don't pretend to be an authoritative
 source on patent law.  All we can say definitively is the original
 patent expires January 7, 2012: subsequent patents may have extended
 this date.

So it's still patented, starting to show cracks, and only really used for 
compatibility with a very deprecated key type and codebase.

It's not even clear where you could get a license if you really had to use 
IDEA.  The mediacrypt.com site where you can get a license was offline for a 
long time.  It's back online now (and goes to the Nagra/Kudelski page, which 
may be amusing to those who used Nagra reel-to-reel tape recorders at one point 
- odd what companies expand into), but I still see nothing about IDEA licensing.

David


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Help adding IDEA within GnuPG 2.0.9

[Palle Sejer Larsen]

Hi group,
I am trying to include support for IDEA within GnuPG 2.0.9 running under 
Linux. I have downloaded the idea.c module via the link on this page: 
http://www.gnupg.org/faq/why-not-idea.html, have compiled it and have 
added the 
load-extension path-to-idea/idea
statement to my conf file in ~/.gnupg/gpg.conf

But it does not seem to load IDEA support anyway. I have placed the idea 
module in the ~/.gnupg/ folder - could that be the problem ? 
I have verified on another server - with GnuPG 1.4.10 installed - that 
here the IDEA support actually gets added with this setup.

The gpg --load-extension path-to-idea/idea -v --version command within 
GnuPG 2.0.9 yields the following:

ba...@psdkxd02:~/.gnupg gpg --load-extension 
/usr/local/ps/batch/.gnupg/idea -v --version
gpg (GnuPG) 2.0.9
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: ~/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA
Cipher: 3DES (S2), CAST5 (S3), BLOWFISH (S4), AES (S7), AES192 (S8),
AES256 (S9), TWOFISH (S10)
Hash: MD5 (H1), SHA1 (H2), RIPEMD160 (H3), SHA256 (H8), SHA384 (H9),
  SHA512 (H10), SHA224 (H11)
Compression: Uncompressed (Z0), ZIP (Z1), ZLIB (Z2), BZIP2 (Z3)
Used libraries: gcrypt(1.4.1)

Any help will be greatly appreciated.

Regards, 
Palle


Medmindre andet er angivet ovenfor: / Unless Otherwise Stated Above:
IBM Danmark ApS
Nymøllevej 91
2800 Kongens Lyngby, Danmark
CVR nr.: 65305216 ___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: How to NOT Use IDEA?

[Laurent Jumet]

Hello Bill !

Bill House bhouse1...@gmail.com wrote:

 The showpref on the key does not mention IDEA, which leaves me also
 with no idea how IDEA is in the mix.

  Cipher: AES256, AES192, AES, CAST5, 3DES
  Digest: SHA256, SHA1, SHA384, SHA512, SHA224
  Compression: ZLIB, BZIP2, ZIP, Uncompressed
  Features: MDC, Keyserver no-modify

If IDEA is set in preferences, list is like mine:

 Cipher: AES, CAMELLIA128, CAMELLIA192, CAMELLIA256, IDEA, TWOFISH, CAST5, 
BLOWFIS
H, 3DES, AES256, AES192
 Digest: RIPEMD160, SHA256, SHA384, SHA512, SHA224, SHA1, MD5
 Compression: ZIP, ZLIB, BZIP2, Uncompressed
 Features: MDC, Keyserver no-modify


But may be GPG.CONF *alone* as a reference to IDEA:
load-extension c:\lib\gnupg\idea.dll

Be aware that a user must set his preferences in his key, save it, and then 
export it on keyservers. Otherwise IDEA may be set and used when encrypting, 
but other people are not aware of it.

-- 
Laurent Jumet
  KeyID: 0xCFAF704C

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: How to NOT Use IDEA?

[Bill House]

The initial install had written a gpg.conf file that seems to have
been the problem.  I replaced it with a new gpg.conf that has the
default-key set to the new keyid I made and the problem is solved.

Thanks to all for the help!

Bill House

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

How to NOT Use IDEA?

[Bill House]

Surely this is a newbie question, but I have been trying for some time to
get GPG to create a signed and encrypted file.  Not wanting to go through
the whole recompile thing and not caring to use the IDEA cipher, it seems to
me that GPG should simply work by default.  Sadly, it does not seem to work
for me.

I created a new RSA/RSA 2048 key in my keyring.  So long as I only want to
encrypt, it works fine.  When I want to encrypt AND sign, it complains that
I need the IDEA algorithm.  When I specify the cipher-algo, it either claims
the cipher is invalid, or it complains that it cannot use IDEA  -- which is
it?  I have tried all the ciphers reported by using gpg --list-packets on
the exported keyfile, to no avail.  Here is the example of my command line:

gpg --armor --cipher-algo cast5 --sign --passphrase yadayada --user
someHexID --recipient someHexID --output output.asc --encrypt input.csv

I am running the Windows version of gpg 1.4.10b

Where have I gone wrong?

Thanks,

Bill
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: How to NOT Use IDEA?

[David Shaw]

On Apr 13, 2010, at 4:06 PM, Bill House wrote:

 Surely this is a newbie question, but I have been trying for some time to get 
 GPG to create a signed and encrypted file.  Not wanting to go through the 
 whole recompile thing and not caring to use the IDEA cipher, it seems to me 
 that GPG should simply work by default.  Sadly, it does not seem to work for 
 me.
 
 I created a new RSA/RSA 2048 key in my keyring.  So long as I only want to 
 encrypt, it works fine.  When I want to encrypt AND sign, it complains that I 
 need the IDEA algorithm.  When I specify the cipher-algo, it either claims 
 the cipher is invalid, or it complains that it cannot use IDEA  -- which is 
 it?  I have tried all the ciphers reported by using gpg --list-packets on the 
 exported keyfile, to no avail.  Here is the example of my command line:
 
 gpg --armor --cipher-algo cast5 --sign --passphrase yadayada --user someHexID 
 --recipient someHexID --output output.asc --encrypt input.csv
 
 I am running the Windows version of gpg 1.4.10b
 
 Where have I gone wrong?

The --sign command belongs at the end of the line, next to --encrypt.  Also, 
what program did you use to create that new RSA/RSA 2048-bit key?

David


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: How to NOT Use IDEA?

[Grant Olson]

On 4/13/2010 4:06 PM, Bill House wrote:
 
 I created a new RSA/RSA 2048 key in my keyring.  So long as I only want
 to encrypt, it works fine.  When I want to encrypt AND sign, it
 complains that I need the IDEA algorithm.  When I specify the
 cipher-algo, it either claims the cipher is invalid, or it complains
 that it cannot use IDEA  -- which is it?  I have tried all the ciphers
 reported by using gpg --list-packets on the exported keyfile, to no
 avail.  Here is the example of my command line:
 
 gpg --armor --cipher-algo cast5 --sign --passphrase yadayada --user
 someHexID --recipient someHexID --output output.asc --encrypt input.csv
 
 I am running the Windows version of gpg 1.4.10b
 
 Where have I gone wrong?
 

Does this happen for any recipient?  Like if you encrypt to yourself, or
me?  Maybe that particular recipient has IDEA in his preferences.  You
can look at his (or your own) preferences by running 'gpg --edit-key
key_id' and then 'showpref'.  Do either of these have IDEA listed as a
cipher?



signature.asc
Description: OpenPGP digital signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: How to NOT Use IDEA?

[Bill House]

The showpref on the key does not mention IDEA, which leaves me also
with no idea how IDEA is in the mix.

 Cipher: AES256, AES192, AES, CAST5, 3DES
 Digest: SHA256, SHA1, SHA384, SHA512, SHA224
 Compression: ZLIB, BZIP2, ZIP, Uncompressed
 Features: MDC, Keyserver no-modify

Bill

 Does this happen for any recipient?  Like if you encrypt to yourself, or
 me?  Maybe that particular recipient has IDEA in his preferences.  You
 can look at his (or your own) preferences by running 'gpg --edit-key
 key_id' and then 'showpref'.  Do either of these have IDEA listed as a
 cipher?

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA patent vs the recent USPTO memorandum

[Johan Wevers]

David Shaw wrote:

If the some people still want this, I haven't seen it in a good long  
while.  Possibly they gave up asking.

Probably. However, if someone wants IDEA support for whatever reason there
is still the IDEA plugin. It still works with GnuPG 1.4.10 for both Linux
and Windows, although I have not tested it with the 2.0 versions.

To say nothing of the fact that compliant OpenPGP implementations are
explicitly banned from generating RFC-1991 keys.

Why is that? Forced upgrading?

Anyway, pgp 2.6.3ia builds just fine on modern Linux and win32 platforms.
For win32, all you have to do is make a project file including all source
files in Visual Studio and compile it. Long filename support etc. comes
automatically so windows users don't have to be stuck with some DOS
executable which would be a pita.

-- 
ir. J.C.A. Wevers //  Physics and science fiction site:
joh...@vulcan.xs4all.nl   //  http://www.xs4all.nl/~johanw/index.html
PGP/GPG public keys at http://www.xs4all.nl/~johanw/pgpkeys.html

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA patent vs the recent USPTO memorandum

[David Shaw]

On Sep 21, 2009, at 2:30 PM, Johan Wevers wrote:


David Shaw wrote:

If the some people still want this, I haven't seen it in a good  
long

while.  Possibly they gave up asking.


Probably. However, if someone wants IDEA support for whatever reason  
there
is still the IDEA plugin. It still works with GnuPG 1.4.10 for both  
Linux

and Windows, although I have not tested it with the 2.0 versions.


There is IDEA support (as this is part of OpenPGP, albeit with patent  
issues), but no V3 key generation support.



To say nothing of the fact that compliant OpenPGP implementations are
explicitly banned from generating RFC-1991 keys.


Why is that? Forced upgrading?


I recall it was not so much forced upgrading, as a general feeling of  
enough already.  If you take a look at the ietf-openpgp archives for  
2003-2004, you'll see a few discussions around it.  Mind you, the  
statistics we played with at the time (4-5 years ago) showed that over  
90% of keys on the keyservers were V4.  I doubt that number has gone  
anywhere but up since then.


Another way to look at it is that the new wording around V3 keys  
(including the no-generate rule) enables someone to write an OpenPGP  
implementation that has no V3 support whatsoever (something which  
wasn't doable in RFC-2440).


David


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA patent vs the recent USPTO memorandum

[M.B.Jr.]

Gentlemen,
I really appreciate the comments you've made on the subject and the
little debates as well.

That was exactly what I was expecting.

Sometimes, regular users do not have the proper notion of whether some
functionality merits attention.

All in all, it looks like IDEA, even if totally freed, is sentenced to
gradual abandonment. Is this perception of mine correct?


Regards,




On Mon, Sep 21, 2009 at 4:48 PM, David Shaw ds...@jabberwocky.com wrote:
 On Sep 21, 2009, at 2:30 PM, Johan Wevers wrote:

 David Shaw wrote:

 If the some people still want this, I haven't seen it in a good long
 while.  Possibly they gave up asking.

 Probably. However, if someone wants IDEA support for whatever reason there
 is still the IDEA plugin. It still works with GnuPG 1.4.10 for both Linux
 and Windows, although I have not tested it with the 2.0 versions.

 There is IDEA support (as this is part of OpenPGP, albeit with patent
 issues), but no V3 key generation support.

 To say nothing of the fact that compliant OpenPGP implementations are
 explicitly banned from generating RFC-1991 keys.

 Why is that? Forced upgrading?

 I recall it was not so much forced upgrading, as a general feeling of
 enough already.  If you take a look at the ietf-openpgp archives for
 2003-2004, you'll see a few discussions around it.  Mind you, the statistics
 we played with at the time (4-5 years ago) showed that over 90% of keys on
 the keyservers were V4.  I doubt that number has gone anywhere but up since
 then.

 Another way to look at it is that the new wording around V3 keys (including
 the no-generate rule) enables someone to write an OpenPGP implementation
 that has no V3 support whatsoever (something which wasn't doable in
 RFC-2440).

 David


 ___
 Gnupg-users mailing list
 Gnupg-users@gnupg.org
 http://lists.gnupg.org/mailman/listinfo/gnupg-users




Marcio Barbado, Jr.

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA patent vs the recent USPTO memorandum

[David Shaw]

On Sep 21, 2009, at 10:11 PM, M.B.Jr. wrote:


Gentlemen,
I really appreciate the comments you've made on the subject and the
little debates as well.

That was exactly what I was expecting.

Sometimes, regular users do not have the proper notion of whether some
functionality merits attention.

All in all, it looks like IDEA, even if totally freed, is sentenced to
gradual abandonment. Is this perception of mine correct?


In my opinion, yes.  These days, you'd need a good reason to use IDEA  
rather than AES, CAST5, or even 3DES.  When you add in the fact that  
IDEA actually costs money (heresy!) and nearly every competitor is  
free, it becomes a fairly easy calculation to make.


In the context of OpenPGP, the gradual abandonment has already  
happened.  The usage today is non-zero, but negligible.  The only  
reason the IDEA discussion comes up here (usually once or twice a  
year) is that PGP 2.x used it back in the 1990s.


David


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA patent vs the recent USPTO memorandum

[Robert J. Hansen]

M.B.Jr. wrote:
 All in all, it looks like IDEA, even if totally freed, is sentenced to
 gradual abandonment. Is this perception of mine correct?

It is more accurate to say it has already been abandoned.  Very few
people today use IDEA as a symmetric cipher for OpenPGP messages.

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA patent vs the recent USPTO memorandum

[vedaal]

Message: 2
Date: Wed, 16 Sep 2009 16:40:02 -0400
From: David Shaw ds...@jabberwocky.com

If the some people still want this, I haven't seen it in a good 
long while.  Possibly they gave up asking.  


as an old-time pgp 2.x user,
have often put the question to some of the die-hard remailer 2.6 
users:

'why don't you just switch to gnupg?'


this is the reason i got in response:

i'm very concerned about my privacy, which is why i bother to use 
a remailer in the first place

i carefully went over every line in the pgp 2.6 sourcecode,
and i'm happy with it

if only there were a gnupg mini-version with a shorter source-code,
(or at least one that's readable by someone looking at it from 
scratch, not just reading the updates and patches as they go along)
then i'd gladly switch

to be fair, 
several of them 'have' switched to Disastry's version, and can use 
any algo or hash in open pgp (except those that came after Disastry 
;-(  )
specifically because his source code is short enough to be readable

(disclaimer,

not by me,
am not at that semi-paranoid level yet,

and at the medium compromise level of:

the stuff i want to encrypt and/or sign, isn't that important 
enough,
and i'm willing to trust experts in the field who have vetted the 
code ;-) )


vedaal


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA patent vs the recent USPTO memorandum

[Robert J. Hansen]

ved...@hush.com wrote:
 if only there were a gnupg mini-version with a shorter source-code,
 (or at least one that's readable by someone looking at it from 
 scratch, not just reading the updates and patches as they go along)
 then i'd gladly switch

This is doable.  I did this in '99 for GnuPG 1.0.  I haven't done it
since, but given the codebase is still in the same ballpark, size-wise,
I find it hard to believe it's impossible today.

It seems strange to imagine there's someone not capable of auditing the
GnuPG code, but is capable of auditing the PGP 2.6 code.

Having read both codebases (albeit not a recent GnuPG codebase), I found
GnuPG's code to be much clearer and easier to understand than PGP 2.6's.


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

IDEA patent vs the recent USPTO memorandum

[M.B.Jr.]

Hi list,
I've recently had access to this document, written by the United
States Patent and Trademark Office (USPTO) which basically tries to
ban software patents.

The memorandum is here:
http://www.uspto.gov/web/offices/pac/dapp/opla/2009-08-25_interim_101_instructions.pdf

the case is,
I'm really interested in reading your opinions of what this could mean
to optional OpenPGP ciphers like IDEA.


Regards,




Marcio Barbado, Jr.

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA patent vs the recent USPTO memorandum

[Robert J. Hansen]

M.B.Jr. wrote:
 I've recently had access to this document, written by the United
 States Patent and Trademark Office (USPTO) which basically tries to
 ban software patents.

The memorandum in question is eight pages, twenty slides and two flowcharts.

As a ballpark estimate that would mean it would take an IP lawyer about
two days to figure out what this means for the specific subject of
patented cryptographic algorithms.  It would take the non-experts on
this list many times that long, if we could do it at all.

There may be patent lawyers on this list who are familiar with the
memorandum in question who are willing to speak in a public forum about
it.  Weirder things have happened.  But speaking for myself, I do not
have the time it takes to (a) become an expert on U.S. patent law, (b)
read the memorandum, and (c) consider how it changes the U.S. patent
system, and (d) write up my results.

If this is important to you, I would suggest speaking with an IP lawyer.

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA patent vs the recent USPTO memorandum

[David Shaw]

On Sep 16, 2009, at 1:56 PM, M.B.Jr. wrote:


Hi list,
I've recently had access to this document, written by the United
States Patent and Trademark Office (USPTO) which basically tries to
ban software patents.

The memorandum is here:
http://www.uspto.gov/web/offices/pac/dapp/opla/2009-08-25_interim_101_instructions.pdf

the case is,
I'm really interested in reading your opinions of what this could mean
to optional OpenPGP ciphers like IDEA.


Whether this means IDEA is okay or not patent-wise, I have a slightly  
different take on this: who cares about IDEA at this point?  IDEA was  
good back in the 90s and PGP 2.x.  It's 2009 now, and we have better  
ciphers than IDEA, a massive installed software base that doesn't use  
IDEA, and nobody is suffering for the lack of IDEA.  If IDEA was  
suddenly not patented, none of this would change.


David


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA patent vs the recent USPTO memorandum

[Joseph Oreste Bruni]

 
On Wednesday, September 16, 2009, at 12:46PM, Robert J. Hansen 
r...@sixdemonbag.org wrote:
M.B.Jr. wrote:
 I've recently had access to this document, written by the United
 States Patent and Trademark Office (USPTO) which basically tries to
 ban software patents.

The memorandum in question is eight pages, twenty slides and two flowcharts.

As a ballpark estimate that would mean it would take an IP lawyer about
two days to figure out what this means for the specific subject of
patented cryptographic algorithms.  It would take the non-experts on
this list many times that long, if we could do it at all.

There may be patent lawyers on this list who are familiar with the
memorandum in question who are willing to speak in a public forum about
it.  Weirder things have happened.  But speaking for myself, I do not
have the time it takes to (a) become an expert on U.S. patent law, (b)
read the memorandum, and (c) consider how it changes the U.S. patent
system, and (d) write up my results.

If this is important to you, I would suggest speaking with an IP lawyer.



Especially for a patent that is due to expire in a year or two.

http://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm





___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA patent vs the recent USPTO memorandum

[Robert J. Hansen]

David Shaw wrote:
 Whether this means IDEA is okay or not patent-wise, I have a slightly
 different take on this: who cares about IDEA at this point?  IDEA was
 good back in the 90s and PGP 2.x.  It's 2009 now, and we have better
 ciphers than IDEA, a massive installed software base that doesn't use
 IDEA, and nobody is suffering for the lack of IDEA.  If IDEA was
 suddenly not patented, none of this would change.

Some people use remailers and other tools which depend on PGP
2.6/RFC1991 traffic.  There are some people who would very much like to
see GnuPG fully support RFC1991 so it can replace the very long in the
tooth PGP 2.6.

Admittedly, I think the correct response is to say, GnuPG /did/ replace
PGP 2.6, the same way RFC4880 replaced RFC1991, now come into the 21st
century with the rest of us.  But many of the die-hard PGP 2.6
advocates resist changing.

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA patent vs the recent USPTO memorandum

[Robert J. Hansen]

David Shaw wrote:
 If the some people still want this, I haven't seen it in a good long
 while.  Possibly they gave up asking.

Gave up the asking, more likely.  I still get one or two emails a year
inquiring about if/when GnuPG will support this.  (No, I don't know why
they email me, and I wish they wouldn't.)

That said, I share in your sentiments.



___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA patent vs the recent USPTO memorandum

[David Shaw]

On Sep 16, 2009, at 4:15 PM, Robert J. Hansen wrote:


David Shaw wrote:

Whether this means IDEA is okay or not patent-wise, I have a slightly
different take on this: who cares about IDEA at this point?  IDEA was
good back in the 90s and PGP 2.x.  It's 2009 now, and we have better
ciphers than IDEA, a massive installed software base that doesn't use
IDEA, and nobody is suffering for the lack of IDEA.  If IDEA was
suddenly not patented, none of this would change.


Some people use remailers and other tools which depend on PGP
2.6/RFC1991 traffic.  There are some people who would very much like  
to

see GnuPG fully support RFC1991 so it can replace the very long in the
tooth PGP 2.6.


If the some people still want this, I haven't seen it in a good long  
while.  Possibly they gave up asking.  Still, it doesn't matter.   
GnuPG is not a RFC-1991 tool, and a theoretical un-patenting of IDEA  
doesn't change that either.  To say nothing of the fact that compliant  
OpenPGP implementations are explicitly banned from generating RFC-1991  
keys.


In effect, the request you're paraphrasing seems to be Add support  
for a dead, deprecated, and weaker format to GnuPG, and then deal with  
a massive software distribution problem so everyone can have the new  
version, all so a few remailers and tools don't have to upgrade to  
OpenPGP.  That argument might have made more sense in 1999, to help  
get people through the transition, but it's not 1999 any more.


I'll go out on a limb and suggest that upgrading the relatively few  
remailers is an easier job...


David


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

GPG2 - IDEA

[Kevin Hilton]

Ok, I've finally managed to compile the gpg2 package (the stable
package, not svn) with cygwin.  Is there a way to add idea support to
gpg2 or is this feature not supported?  Thanks

-- 
Kevin Hilton

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Doe MediaCrypt (IDEA) exist anymore?

[[EMAIL PROTECTED]]

Thanks,  unfortunately I have to decrypt some legacy apps files that does use
IDEA.



David Shaw wrote:
 
 On Thu, Sep 18, 2008 at 07:08:48AM -0700, [EMAIL PROTECTED] wrote:
 
 Hi,
 I need to use GnuPG with older keys using IDEA.  This is for commecial
 use. 
 I see that for commercial use, we need to purchase a license from
 MediaCrypt?  But they do not seem to have a web sight anymore.   What do
 I
 do now?  Where can I purchase the IDEA license?
 
 Good luck.  The mediacrypt web page has been offline for months.  I'd
 suggest contacting MediaCrypt AG via the address given in their domain
 registration.  See http://whois.domaintools.com/mediacrypt.com You
 also might try contacting someone at Ascom: http://www.ascom.com
 
 I don't know your situation, of course, but I do know that in
 virtually all cases, people don't actually need IDEA, and can do just
 fine without it.
 
 David
 
 ___
 Gnupg-users mailing list
 Gnupg-users@gnupg.org
 http://lists.gnupg.org/mailman/listinfo/gnupg-users
 
 

-- 
View this message in context: 
http://www.nabble.com/Doe-MediaCrypt-%28IDEA%29-exist-anymore--tp19553772p19562769.html
Sent from the GnuPG - User mailing list archive at Nabble.com.


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Doe MediaCrypt (IDEA) exist anymore?

[Werner Koch]

On Thu, 18 Sep 2008 16:08, [EMAIL PROTECTED] said:

 I need to use GnuPG with older keys using IDEA.  This is for commecial use. 
 I see that for commercial use, we need to purchase a license from

It doesn't matter how you use it, that algorithm is patented in most
countries and thus it does not matter how you use it.  It is true that
the patent holder once allowed certain usages of PGP2.x without the need
to pay royalties but that was specific for a certain version of PGP.

Note that you may not distribute GnuPG if modified to use IDEA as per
the GPL section 11.



Shalom-Salam,

   Werner



-- 
Linux-Kongress 2008 + Hamburg + October 7-10 + www.linux-kongress.org

   Die Gedanken sind frei.  Auschnahme regelt ein Bundeschgesetz.


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Doe MediaCrypt (IDEA) exist anymore?

[[EMAIL PROTECTED]]

Hi,
I need to use GnuPG with older keys using IDEA.  This is for commecial use. 
I see that for commercial use, we need to purchase a license from
MediaCrypt?  But they do not seem to have a web sight anymore.   What do I
do now?  Where can I purchase the IDEA license?

Thaks
Rob

-- 
View this message in context: 
http://www.nabble.com/Doe-MediaCrypt-%28IDEA%29-exist-anymore--tp19553772p19553772.html
Sent from the GnuPG - User mailing list archive at Nabble.com.


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Doe MediaCrypt (IDEA) exist anymore?

[David Shaw]

On Thu, Sep 18, 2008 at 07:08:48AM -0700, [EMAIL PROTECTED] wrote:
 
 Hi,
 I need to use GnuPG with older keys using IDEA.  This is for commecial use. 
 I see that for commercial use, we need to purchase a license from
 MediaCrypt?  But they do not seem to have a web sight anymore.   What do I
 do now?  Where can I purchase the IDEA license?

Good luck.  The mediacrypt web page has been offline for months.  I'd
suggest contacting MediaCrypt AG via the address given in their domain
registration.  See http://whois.domaintools.com/mediacrypt.com You
also might try contacting someone at Ascom: http://www.ascom.com

I don't know your situation, of course, but I do know that in
virtually all cases, people don't actually need IDEA, and can do just
fine without it.

David

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

1.4.9 (IDEA not working?)

[vedaal]

have installed gnupg 1.4.9 using the windows binary,
and IDEA no longer loads

have tried this again on a usb drive, replacing all the gnupg 1.4.8 
files with 1.4.9 files,
but leaving the idea.dll, gpg.conf, keyrings and trust db the same 
as they were for 1.4.8

and even tested it before the replacement
1.4.8 loads IDEA
1.4.9 does not

here is my gpg.conf in case i overlooked anything

##gpg2go  drive
comment Acts of Kindness better the World, and protect the Soul
keyring v:\gnupg\pubring.gpg
secret-keyring v:\gnupg\secring.gpg
no-default-keyring
trustdb-name v:\gnupg\trustdb.gpg
cipher-algo TWOFISH
digest-algo SHA256
#digest-algo SHA1
compress-algo ZIP
homedir v:\gnupg
load-extension v:\gnupg\idea.dll
#local-user 0x5AA20C866A589A97!
#hidden-encrypt-to 0x5AA20C866A589A97
s2k-cipher-algo twofish
s2k-digest-algo SHA256
cert-digest-algo SHA256
#digest-algo sha1
#digest-algo ripemd160
verbose
verbose
ignore-crc-error
ignore-mdc-error
show-session-key
expert
#throw-keyids
#try-all-secrets
#default-key 6A589A97!
default-key D35FB186

(v:\ is the truecrypt drive letter i use for volume that has gnupg 
and the keyrings)

can anyone else confirm this,
or did i make a mistake somnehwere
(other than still using a v3 key and idea ;-))  )

TIA,

vedaal


any ads or links below this message are added by hushmail without 

--
Click here to choose from a huge selection of shipping supplies!
http://tagline.hushmail.com/fc/REAK6ZBPnMblQux3ayDSua5qXy6KnlPR1TiJywFAh70Sdppg1Q6tLB/
my endorsement or awareness of the nature of the link


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

1.4.9 IDEA still works,// sorry, my mistake

[vedaal]

sorry,

a silly oversight on my part, ;-((
IDEA loads fine on 1.4.9

vedaal

any ads or links below this message are added by hushmail without 

--
Click to recieve credit card help and get out of debt fast.
http://tagline.hushmail.com/fc/REAK6ZBOk4NIwhYiT5hHUXjgn2GYzFMx1ahERXmgLhbVQ6NHRxQfyn/
my endorsement or awareness of the nature of the link


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

IDEA not always working in GNUPG

[Anonymous Remailer (austria)]

Hi,

I occasionally receive messages encrypted by older PGP versions that are
not being decrypted by GNUPG 1.4.7

[scrubbed] gpg filename
gpg: assuming IDEA encrypted data
Enter passphrase: [scrubbed]

gpg: [don't know]: invalid packet (ctb=67)
gpg: WARNING: message was not integrity protected
gpg: [don't know]: invalid packet (ctb=0a)


Here is the output of gpg --version:

[scrubbed] gpg --version
gpg (GnuPG) 1.4.7
Copyright (C) 2006 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.

Home: ~/.gnupg
Supported algorithms:
Pubkey: RSA, RSA-E, RSA-S, ELG-E, DSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH
Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

Is this normal behaviour? I'm getting round by using PGP to decrypt IDEA
messages that gpg won't decrypt but gpg does work with some IDEA
messages so I can't figure whats wrong.

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

IDEA?

[Maury Markowitz]

Didn't IDEA's patent expire last year? I notice it's still not in the
list unless I load it by hand. Is there something else preventing it
from being used?

Maury

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: IDEA?

[David Shaw]

On Tue, Mar 04, 2008 at 11:51:13AM -0500, Maury Markowitz wrote:
 Didn't IDEA's patent expire last year? I notice it's still not in the
 list unless I load it by hand. Is there something else preventing it
 from being used?

It's patented until 2010 (2011 in some places).

IDEA is effectively dead.  I don't mean that as a knock against IDEA -
it was a fine cipher for its time, but time has moved on.  The only
reason to use IDEA is if you want to be compatible with PGP 2
messages.

David

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users