Re: isolating the signature from encrypted data (was: sign encrypted emails)

2014-01-05 Thread Hauke Laging
Am Mo 06.01.2014, 01:47:39 schrieb MFPA: > Most "signed and encrypted" messages created with PGP or GnuPG have > the two processes applied together - you do not normally decrypt a > message and then see a signed message as the output. That is correct. I am not aware of a possibility to get the da

Re: sign encrypted emails

2014-01-05 Thread MFPA
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi On Friday 3 January 2014 at 10:28:28 AM, in , Hauke Laging wrote: MFPA: >> Again, this would be flagged up if the sender was in >> the habit of signing outgoing messages (as you >> stated). > No, it wouldn't. The reason is that the signature

Re: sign encrypted emails

2014-01-05 Thread Robert J. Hansen
> Let me guess: Modifying the mail client so that it automatically removes > the word "not" would be illegitimate because for some strange reason > that would be "solving social problems by technical means"... Hauke, at this point you've advocated your idea -- strongly -- and you've received a g

Re: sign encrypted emails

2014-01-05 Thread Hauke Laging
Am So 05.01.2014, 16:41:11 schrieb Doug Barton: > It can be both trivial and reliable, simply place the following in > your .signature file: > > I will not encrypt this message before sending. > > On those occasions when you do encrypt, remove the word "not." Let me guess: Modifying the mail cl

Re: sign encrypted emails

2014-01-05 Thread Doug Barton
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 01/05/2014 08:07 AM, Hauke Laging wrote: | Am So 05.01.2014, 10:15:51 schrieb Robert J. Hansen: | |> >Your problem can be solved trivially by establishing a policy of, |> >"Encrypted messages must contain a notification within the signed |> >mess

Re: sign encrypted emails

2014-01-05 Thread Johannes Zarl
On Sunday 05 January 2014 03:10:48 Leo Gaspard wrote: > Well... I, personally, would attach more importance (no more validity, just > importance, like in "listen to me very well" or whatever english people say > to others to get them to listen carefully) to a message signed to an > offline main key

Re: sign encrypted emails

2014-01-05 Thread Leo Gaspard
On Sat, Jan 04, 2014 at 10:28:26PM +0100, Johannes Zarl wrote: > On Saturday 04 January 2014 16:09:51 Leo Gaspard wrote: > > On Fri, Jan 03, 2014 at 07:31:29PM -0500, Daniel Kahn Gillmor wrote: > > > In your example, the fact that a message was encrypted makes the > > > recipient treat it as though

Re: sign encrypted emails

2014-01-05 Thread Ingo Klöcker
On Sunday 05 January 2014 14:04:49 Peter Lebbing wrote: > [1] By the way, your statement might not even be true; how often have > you written "See the attachment" and then forgetting to attach the > file? I have done it countless times. I bet Hauke never forgot to attach the file because he is usi

Re: V3 key lookup

2014-01-05 Thread Nicholas Cole
On Sun, Jan 5, 2014 at 1:24 PM, Nicholas Cole wrote: > Dear list, > > I've been implementing a local version of > > http://tools.ietf.org/html/draft-shaw-openpgp-hkp-00 > > for some experimenting. > > I have a server working listening on local host and replying with the > correct formats to the de

Re: sign encrypted emails

2014-01-05 Thread Robert J. Hansen
> That is neither trivial nor reliable nor the best approach to deliver > this information. It is a trivial fix; whether it is reliable depends on how committed participants are towards enforcing policy. > As I said in my first mail in this thread this isn't about changing > GnuPG at all becaus

Re: sign encrypted emails

2014-01-05 Thread Hauke Laging
Am So 05.01.2014, 10:15:51 schrieb Robert J. Hansen: > Your problem can be solved trivially by establishing a policy of, > "Encrypted messages must contain a notification within the signed > message body of who the message is encrypted for." That is neither trivial nor reliable nor the best appro

Re: sign encrypted emails

2014-01-05 Thread Robert J. Hansen
> Don't write "I will encrypt this message"[1] in every mail hoping that the > recipient deduces that you want to do secret stuff, and leaving them to deduce > from the absence of that message that you want to do the regular stuff. Hoping > that other people will infer meaning from things that are

Re: USB key form-factor smart-card readers with pinpads?

2014-01-05 Thread Sam Kuper
On Jan 5, 2014 1:18 PM, "Werner Koch" wrote: > On Sun, 5 Jan 2014 05:02, sam.ku...@uclmail.net said: > Take care: The Omnikey does not work with free software and 2048 bit > or larger keys. Better get a Gemalto or Identive (SCM) reader. Thanks for the warning :) > > In group 2 above, the small

Re: sign encrypted emails

2014-01-05 Thread Robert J. Hansen
> I agree with Robert, you're trying to solve a social problem with a technical > solution. More to the point, he's solving the wrong problem and conflating policy with mechanism. GnuPG does not provide policy. Policy is the responsibility of the people using GnuPG. All GnuPG provides is mechan

V3 key lookup

2014-01-05 Thread Nicholas Cole
Dear list, I've been implementing a local version of http://tools.ietf.org/html/draft-shaw-openpgp-hkp-00 for some experimenting. I have a server working listening on local host and replying with the correct formats to the defined requests. Everything works fine with version 4 keys, but if gpg

Re: sign encrypted emails

2014-01-05 Thread Peter Lebbing
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 05/01/14 11:15, Hauke Laging wrote: > Why should I write "I will encrypt this message to 0x12345678" in every > mail which is boring, easily forgotten and error-prone if the problem can > *easily* be solved technically with much better results? Don

Re: USB key form-factor smart-card readers with pinpads?

2014-01-05 Thread Werner Koch
On Sun, 5 Jan 2014 05:02, sam.ku...@uclmail.net said: > conventional USB stick-sized readers (e.g. Omnikey 6121) + ID-000 Take care: The Omnikey does not work with free software and 2048 bit or larger keys. Better get a Gemalto or Identive (SCM) reader. > In group 2 above, the smallest reader

Re: Quantum computing

2014-01-05 Thread Johan Wevers
On 4-1-2014 13:31, micha137 wrote: > A spoofing organization is no fertile ground for true innovation. The > real scientists, not the NSA are going to make progress in quantum > computing. And it is not going to be as cheap as some tens of megabucks. > Progress to get it practical will be painfull

Re: keysigning: lsign and offline master key

2014-01-05 Thread nb.linux
Daniel Kahn Gillmor: > 0) --export-options export-local on your air-gapped system, combined > with --import-options import-local on your "regular" system. > Would either of these workflows meet your goals? Thanks! That's exactly what I was looking for. -- nb.linux

Re: sign encrypted emails

2014-01-05 Thread Hauke Laging
Am So 05.01.2014, 10:35:44 schrieb Peter Lebbing: > On 05/01/14 04:38, Hauke Laging wrote: > > You are aware that is doesn't make any sense to make this claim > > without any argument after the opposite has been claimed with an > > argument (a very strong one)? > > Eh? You yourself start this who

Re: sign encrypted emails

2014-01-05 Thread Peter Lebbing
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 05/01/14 04:38, Hauke Laging wrote: > You are aware that is doesn't make any sense to make this claim without any > argument after the opposite has been claimed with an argument (a very > strong one)? Eh? You yourself start this whole discussion by