please give us safer defaults for gnupg

2013-12-16 Thread adrelanos
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi! [This was originally planed as an open letter, but I thought it might be better to hear your arguments beforehand.] We think gnupg still is the most used and most important encryption tool in the Free Software community. [1] But there is a big

[Announce] Libgcrypt 1.6.0 released

2013-12-16 Thread Werner Koch
Hello! The GNU project is pleased to announce the availability of Libgcrypt version 1.6.0. This is the new stable version of Libgcrypt with the API being mostly compatible to previous versions. Due to the removal of certain long deprecated functions this version introduces an ABI change.

Re: Another step towards crowdfunding

2013-12-16 Thread Micah Lee
On 12/14/2013 09:32 AM, Sam Tuke wrote: This has been on the todo list for a while (the blog is all static hand written HTML at the moment). I made separate pages as requested just now and they're online. Should make linking easier (just click on the article headings on the blog front page).

Re: [Announce] Libgcrypt 1.6.0 released

2013-12-16 Thread Peter Lebbing
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 16/12/13 18:49, Werner Koch wrote: * Added support for Deterministic DSA as per RFC-6969. I think this is a typo and you mean RFC-6979 Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm

Re: please give us safer defaults for gnupg

2013-12-16 Thread Werner Koch
On Mon, 16 Dec 2013 18:37, adrela...@riseup.net said: [This was originally planed as an open letter, but I thought it might be better to hear your arguments beforehand.] May I suggest to read the archives of just a few weeks to collect the reasons why suggestions of using SHA-512 are missing

Re: please give us safer defaults for gnupg

2013-12-16 Thread Robert J. Hansen
We think... If you're writing on behalf of a group, I would love to know the name of the group and the names of its members. Otherwise, I can only assume you are suffering a mental illness and are speaking for the multiple voices in your head -- either that or else perhaps you're

X.509 certificates for https://gnupg.org [was: Re: Another step towards crowdfunding]

2013-12-16 Thread Daniel Kahn Gillmor
On 12/16/2013 02:32 PM, Micah Lee wrote: Also, looks like the CA is CAcert--an awesome CA, but not trusted by browsers by default. I'd suggest getting a cert from StartSSL [https://startssl.com/], since they're they only CA that gives certs for free. And a wildcard cert (for *.gnupg.org) ends

Re: X.509 certificates for https://gnupg.org [was: Re: Another step towards crowdfunding]

2013-12-16 Thread Robert J. Hansen
for well-known free software projects (Also, as a business in Israel, StartSSL is the target of an ongoing international boycott due to Israeli domestic policy -- http://www.bdsmovement.net/). Although I support each person's right to believe what they want with respect to Israeli domestic

Re: Sharing/Storing a private key

2013-12-16 Thread Doug Barton
On 12/15/2013 04:58 AM, Peter Lebbing wrote: On 14/12/13 21:14, Leo Gaspard wrote: Maybe if you explained what the limitations of are...? My guess is the fact that only supports secrets up to 1024 bits; if you want to share a larger secret you need to do a hybrid approach where you

Re: please give us safer defaults for gnupg

2013-12-16 Thread adrelanos
Werner Koch: On Mon, 16 Dec 2013 18:37, adrela...@riseup.net said: [This was originally planed as an open letter, but I thought it might be better to hear your arguments beforehand.] May I suggest to read the archives of just a few weeks to collect the reasons why suggestions of using

Re: please give us safer defaults for gnupg

2013-12-16 Thread adrelanos
Robert J. Hansen: We think... If you're writing on behalf of a group, I would love to know the name of the group and the names of its members. Understandable. At the moment it's just one person sharing that opinion. [Didn't ask many more yet.] I asked if I am allowed to tell names, probably

Re: please give us safer defaults for gnupg

2013-12-16 Thread Robert J. Hansen
On 12/16/2013 6:11 PM, adrelanos wrote: When I searched for this on search engines, I haven't found one in a project's character. (I.e. were it's open for debate/pull requests/changes.) Perhaps not, but you *did* find them. Your original email referenced, for instance, the Debian GnuPG

Re: X.509 certificates for https://gnupg.org [was: Re: Another step towards crowdfunding]

2013-12-16 Thread Micah Lee
On 12/16/2013 12:35 PM, Daniel Kahn Gillmor wrote: Regardless of how you feel about the CA cartel in general, StartSSL is not the only member of the cartel offering gratis certs, particularly for well-known free software projects Oh interesting, I didn't realize there were other CAs that give

Libgcrypt 1.6.0 released and gunpg 2.x

2013-12-16 Thread shm...@riseup.net
this looks like a significant upgrade if i have already compiled gnupg 2.x with libgcrypt 1.5.3, and i want to use the new 1.6.0, do i need to uninstall gnupg libcrypt and then compile both again together, and re-install ? gnupg 2.x would not work with the new libgcrypt if i just install it