Re: PGP/GnuPG unsecure, should be replaced?
I must have picked that up somewhere I didn't check when I was younger and just took it as fact leading to fail :( Sorry! I am not a cryptographic expert - IANACE?? Iain On Sun, Jul 21, 2019 at 8:11 PM Elmar Stellnberger wrote: > Why do you think that TwoFish is bad? It was invented by Bruce Schneier > and was in the last round of the AES competition. I believe it to be the > better choice than AES. > Am 20.07.19 um 21:41 schrieb Iain Grant: > > 2 fish... that in it's self is bad. AES, sure lets all be ok about > that. > > I also read the article and I realise I still rely on gpg far too much and > that I need to ween myself off of it! > > > Iain > > On Sat, Jul 20, 2019 at 8:33 PM qmi (list) wrote: > >> Hi, >> >> On 7/19/19 1:34 PM, Stephan Seitz wrote: >> > I found the following article about PGP/GnuPG: >> > https://latacora.singles/2019/07/16/the-pgp-problem.html >> > >> > In short you should drop GnuPG because it doesn’t do anything really >> > the right way. It should be replaced with different tools for >> > different situations. >> >> I checked that article. For e.g. the article says, "If you’re lucky, >> your local GnuPG defaults to 2048-bit RSA, the 64-bit-block CAST5 cipher >> in CFB, ..." >> >> Wrong. The current implementation of GnuPG shipped by Debian Buster - >> version 2.2.12 - does support modern cryptographic standards for >> symmetric encryption, not only CAST5. For e.g., it does support twofish >> and aes. Both of which use 128-bit block sizes, AFAIK. See command >> output for gpg below about supported algorithms: >> >> " >> >> qmi@qmiacer:~$ gpg --version >> >> gpg (GnuPG) 2.2.12 >> (...) >> Supported algorithms: >> Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA >> Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, >> CAMELLIA128, CAMELLIA192, CAMELLIA256 >> (...) >> " >> >> So it's good enough, apparently. >> >> > >> > Debian is using GnuPG for signing files. From the article: >> > >> > Signing Packages >> > >> > Use Signify/Minisign. Ted Unangst will tell you all about it. It’s what >> >> You may be right, though. That tool might have better bindings for >> modern programming languages. >> >> Regards, >> -- >> qmi >> Email: li...@miklos.info >> >>
Re: PGP/GnuPG unsecure, should be replaced?
2 fish... that in it's self is bad. AES, sure lets all be ok about that. I also read the article and I realise I still rely on gpg far too much and that I need to ween myself off of it! Iain On Sat, Jul 20, 2019 at 8:33 PM qmi (list) wrote: > Hi, > > On 7/19/19 1:34 PM, Stephan Seitz wrote: > > I found the following article about PGP/GnuPG: > > https://latacora.singles/2019/07/16/the-pgp-problem.html > > > > In short you should drop GnuPG because it doesn’t do anything really > > the right way. It should be replaced with different tools for > > different situations. > > I checked that article. For e.g. the article says, "If you’re lucky, > your local GnuPG defaults to 2048-bit RSA, the 64-bit-block CAST5 cipher > in CFB, ..." > > Wrong. The current implementation of GnuPG shipped by Debian Buster - > version 2.2.12 - does support modern cryptographic standards for > symmetric encryption, not only CAST5. For e.g., it does support twofish > and aes. Both of which use 128-bit block sizes, AFAIK. See command > output for gpg below about supported algorithms: > > " > > qmi@qmiacer:~$ gpg --version > > gpg (GnuPG) 2.2.12 > (...) > Supported algorithms: > Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA > Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, > CAMELLIA128, CAMELLIA192, CAMELLIA256 > (...) > " > > So it's good enough, apparently. > > > > > Debian is using GnuPG for signing files. From the article: > > > > Signing Packages > > > > Use Signify/Minisign. Ted Unangst will tell you all about it. It’s what > > You may be right, though. That tool might have better bindings for > modern programming languages. > > Regards, > -- > qmi > Email: li...@miklos.info > >
Re: scan
* nathan ([EMAIL PROTECTED]) wrote: I would very carefully go over your hardware setup, and the configuration of the server. I would run the offending scan many times, altering different things to try and determine some predictable behaviors, and I would go over the server logs to see if the reason for the reboot was logged. i'd also (naively?) suggest rolling your own kernel, just in case something in the debian kernel is conflicting with your hardware, and test against that one. iain -- wh33, y1p33 3tc. If sharing a thing in no way diminishes it, it is not rightly owned if it is not shared. -St. Augustine
Forcing encryption algorithm w/Freeswan 1.96
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi Everyone, Does anyone have any idea how to force Freeswan to use AES/Rijndael? I have insmodded the AES module, and it appears to be working, since I can set the encryption algorithm to AES from a windows VPN client. Cheers, Iain Smith -BEGIN PGP SIGNATURE- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE+cdDD3wwzMsPrRpsRAsEtAJ9C1+0L7OOc5BSrixjv6YSgISCsNQCcCvo+ v9PHc/FtlSlSDw5BuOVmyI4= =MRzb -END PGP SIGNATURE- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: Forcing encryption algorithm w/Freeswan 1.96
On Friday 14 March 2003 1:37 pm, Andrea Frigido wrote: try with ike=aes128-sha,aes128-md5 option into your connection section into /etc/ipsec.conf Thanks, but won't that only affect the encryption used by ike rather than ipsec? Iain -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Forcing encryption algorithm w/Freeswan 1.96
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi Everyone, Does anyone have any idea how to force Freeswan to use AES/Rijndael? I have insmodded the AES module, and it appears to be working, since I can set the encryption algorithm to AES from a windows VPN client. Cheers, Iain Smith -BEGIN PGP SIGNATURE- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE+cdDD3wwzMsPrRpsRAsEtAJ9C1+0L7OOc5BSrixjv6YSgISCsNQCcCvo+ v9PHc/FtlSlSDw5BuOVmyI4= =MRzb -END PGP SIGNATURE-
Re: Forcing encryption algorithm w/Freeswan 1.96
On Friday 14 March 2003 1:37 pm, Andrea Frigido wrote: try with ike=aes128-sha,aes128-md5 option into your connection section into /etc/ipsec.conf Thanks, but won't that only affect the encryption used by ike rather than ipsec? Iain
Re: Don't panic (ssh)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 14 January 2002 at 10:35:17 Thomas Seyrat wrote: TS Not if your SSH daemon is up to date :-) Is the SSHD in the latest potato fully up-to-date, though? I am a very recent convert to Debian, having been an avid Slackware fan for the last seven years. However one of my (very old) Slack boxen was compromised on Christmas Day via the sshd CRC32 vulnerability and I decided to replace it with Debian, a distro which has seriously impressed me. Not wanting the same problem to reoccur, after installation configuration I checked my version of sshd. As far as I could ascertain the sshd which comes with the current potato release is OpenSSH 1.something (can't say exactly what now as I've removed it and my notes are all at home), however iirc it was only using version 1 of the SSH protocols, which leaves the vulnerability in place. I removed the Debian SSH package manually installed OpenSSH 3.0.2p1 which is invulnerable (so far!) to all known vulnerabilities as long as version 1 of the SSH protocol isn't used, even as a fallback. Have I missed something and was I already OK, or is the current stable potato release shipping with a potential ssh security hole? Cheers - -- Iain | PGP mail preferred: pubkey @ www.deepsea.f9.co.uk/misc/iain.asc Versace Prada mean nothing to me, You buy your friends but I'll hate you for free Rescue Kyoto, boycott Esso/Exxon/Mobil: http://www.stopesso.com -BEGIN PGP SIGNATURE- Version: PGP 6.5i iQA/AwUBPEK8BWByUNb+aO+GEQJfogCghHz4ajXP81s4OwS2/HOMx8sbXgIAoJLo moxb226Bpj+mLJ7wp4PVsJbK =wRJH -END PGP SIGNATURE- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: Don't panic (ssh)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 14 January 2002 at 11:48:34 [EMAIL PROTECTED] wrote: Have I missed something and was I already OK, or is the current stable potato release shipping with a potential ssh security hole? AFAIK, all SSH1 connections are vulnerable to the CRC32 attack. Thus you need to use SSH2 protocol. OpenSSH supports SSH2. You need different keys though, as SSH2 so far does not support RSA keypairs and needs DSA keys. That's the impression I was under, too. In which case the current stable release of Debian comes with an sshd which uses protocol 1 and is therefore open to allowing remote root compromises. Is there any way to find out what flavour of Debian I have which is more detailed than this: iain@starfish:~$ cat /etc/debian_version 2.2 Cheers - -- Iain | PGP mail preferred: pubkey @ www.deepsea.f9.co.uk/misc/iain.asc Versace Prada mean nothing to me, You buy your friends but I'll hate you for free Rescue Kyoto, boycott Esso/Exxon/Mobil: http://www.stopesso.com -BEGIN PGP SIGNATURE- Version: PGP 6.5i iQA/AwUBPELMV2ByUNb+aO+GEQJQ9gCgi8S43E7EeimjmNgVxdVQ0lIcBcgAoNxK VUCUJvFQB8mjDD47v4eFyyly =6JW1 -END PGP SIGNATURE- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: Don't panic (ssh)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 14 January 2002 at 13:05:57 Craigsc wrote: How do you disable ssh1 protocol with the current ssh on potato ? I may be very wrong here as I've only been using Debian for 3 days now, but as far as I can see the current sshd on potato only supports ssh1 protocol. That's why I removed the package and self-compiled the latest sources from www.openssh.org to ensure I had only ssh2 protocol compiled in. I've had a box compromised through the ssh1 CRC32 vulnerability once, I'm not going to let it happen again! Cheers - -- Iain | PGP mail preferred: pubkey @ www.deepsea.f9.co.uk/misc/iain.asc Versace Prada mean nothing to me, You buy your friends but I'll hate you for free Rescue Kyoto, boycott Esso/Exxon/Mobil: http://www.stopesso.com -BEGIN PGP SIGNATURE- Version: PGP 6.5i iQA/AwUBPELbYWByUNb+aO+GEQL/FACeMwMQY9nvTPpORPRdKpd6X5ret8EAoIcI 966spRQfdUFlD2D8KHY8TAN/ =9qaj -END PGP SIGNATURE- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: Don't panic (ssh)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 14 January 2002 at 10:35:17 Thomas Seyrat wrote: TS Not if your SSH daemon is up to date :-) Is the SSHD in the latest potato fully up-to-date, though? I am a very recent convert to Debian, having been an avid Slackware fan for the last seven years. However one of my (very old) Slack boxen was compromised on Christmas Day via the sshd CRC32 vulnerability and I decided to replace it with Debian, a distro which has seriously impressed me. Not wanting the same problem to reoccur, after installation configuration I checked my version of sshd. As far as I could ascertain the sshd which comes with the current potato release is OpenSSH 1.something (can't say exactly what now as I've removed it and my notes are all at home), however iirc it was only using version 1 of the SSH protocols, which leaves the vulnerability in place. I removed the Debian SSH package manually installed OpenSSH 3.0.2p1 which is invulnerable (so far!) to all known vulnerabilities as long as version 1 of the SSH protocol isn't used, even as a fallback. Have I missed something and was I already OK, or is the current stable potato release shipping with a potential ssh security hole? Cheers - -- Iain | PGP mail preferred: pubkey @ www.deepsea.f9.co.uk/misc/iain.asc Versace Prada mean nothing to me, You buy your friends but I'll hate you for free Rescue Kyoto, boycott Esso/Exxon/Mobil: http://www.stopesso.com -BEGIN PGP SIGNATURE- Version: PGP 6.5i iQA/AwUBPEK8BWByUNb+aO+GEQJfogCghHz4ajXP81s4OwS2/HOMx8sbXgIAoJLo moxb226Bpj+mLJ7wp4PVsJbK =wRJH -END PGP SIGNATURE-
Re: Don't panic (ssh)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 14 January 2002 at 11:48:34 [EMAIL PROTECTED] wrote: Have I missed something and was I already OK, or is the current stable potato release shipping with a potential ssh security hole? AFAIK, all SSH1 connections are vulnerable to the CRC32 attack. Thus you need to use SSH2 protocol. OpenSSH supports SSH2. You need different keys though, as SSH2 so far does not support RSA keypairs and needs DSA keys. That's the impression I was under, too. In which case the current stable release of Debian comes with an sshd which uses protocol 1 and is therefore open to allowing remote root compromises. Is there any way to find out what flavour of Debian I have which is more detailed than this: [EMAIL PROTECTED]:~$ cat /etc/debian_version 2.2 Cheers - -- Iain | PGP mail preferred: pubkey @ www.deepsea.f9.co.uk/misc/iain.asc Versace Prada mean nothing to me, You buy your friends but I'll hate you for free Rescue Kyoto, boycott Esso/Exxon/Mobil: http://www.stopesso.com -BEGIN PGP SIGNATURE- Version: PGP 6.5i iQA/AwUBPELMV2ByUNb+aO+GEQJQ9gCgi8S43E7EeimjmNgVxdVQ0lIcBcgAoNxK VUCUJvFQB8mjDD47v4eFyyly =6JW1 -END PGP SIGNATURE-
Re: Don't panic (ssh)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 14 January 2002 at 13:05:57 Craigsc wrote: How do you disable ssh1 protocol with the current ssh on potato ? I may be very wrong here as I've only been using Debian for 3 days now, but as far as I can see the current sshd on potato only supports ssh1 protocol. That's why I removed the package and self-compiled the latest sources from www.openssh.org to ensure I had only ssh2 protocol compiled in. I've had a box compromised through the ssh1 CRC32 vulnerability once, I'm not going to let it happen again! Cheers - -- Iain | PGP mail preferred: pubkey @ www.deepsea.f9.co.uk/misc/iain.asc Versace Prada mean nothing to me, You buy your friends but I'll hate you for free Rescue Kyoto, boycott Esso/Exxon/Mobil: http://www.stopesso.com -BEGIN PGP SIGNATURE- Version: PGP 6.5i iQA/AwUBPELbYWByUNb+aO+GEQL/FACeMwMQY9nvTPpORPRdKpd6X5ret8EAoIcI 966spRQfdUFlD2D8KHY8TAN/ =9qaj -END PGP SIGNATURE-
PGP 2.x/GnuPG compatibility problems
I originally posted this on the GnuPG mailing list and recieved no reply. Hopefully some debian security buffs can help me with this. I am having problems veryifing some keys signed with a key generated with pgp2.6ui The key wasn't self-signed originally. I was able to import it using --allow-non-selfsigned-uid And i convinced the key owner to self sign it so I now have a self-signed version. However any keys that he has signed I can't use. When I try and encrypt to these keys I get the following error: jackal:~$ gpg -ea -r bunglon test.txt gpg: bunglon: skipped: unusable public key gpg: test.txt: encryption failed: unusable public key I have given full trust to the original signing key. Using PGP 6.5.8 I get a similar error: Key for user ID: bunglon [EMAIL PROTECTED] 1024-bit RSA key, Key ID 0xB5DDA201, created 1999/07/21 WARNING: Because this public key is not certified with a trusted signature, it is not known with high confidence that this public key actually belongs to: bunglon [EMAIL PROTECTED]. Are you sure you want to use this public key (y/N)? However using PGP 6.0.2i on windows I have no such problems. Checking the signature gives the following: jackal:~$ gpg --check-sigs bunglon pub 1024R/B5DDA201 1999-07-21 bunglon [EMAIL PROTECTED] sig- 69FC1101 1999-07-21 kholil [EMAIL PROTECTED] I assume the - means the signature is invalid. I have hunted the docs for info about this but found nothing. So, is this a bug or am I doing something wrong? Please help, Iain. -- public key available at http://www.minihub.org/~iain/iain.asc
Backing up encrypted filesystem
Hi, I have been using reiserfs on top of an encrypted filesystem (serpent) for a couple of months with no problems until last night when the reiserfs crashed. This brings me to my question. Is it possible to burn this filesystem onto a CDR. I have tried unsuccessfully both by using the encrypted file as the image file and also just burning the file onto a iso9660 filesystem. Oh and if anyone knows how to recover a reiserfs with the following error I would be really grateful. -debugreiserfs, 2001- reiserfsprogs 3.x.0j reiserfs_open: first bitmap looks corrupted Super block of format 3.6 found on the 0x3 in block 16 Block count 163840 Blocksize 4096 Free blocks 149868 Busy blocks (skipped 16, bitmaps - 5, journal blocks - 8193 1 super blocks, 5757 data blocks Root block 8214 Journal block (first) 18 Journal dev 0 Journal orig size 8192 Filesystem state VALID Tree height 3 Hash function used to sort names: r5 Objectid map size 18, max 972 Version 2
Backing up encrypted filesystem
Hi, I have been using reiserfs on top of an encrypted filesystem (serpent) for a couple of months with no problems until last night when the reiserfs crashed. This brings me to my question. Is it possible to burn this filesystem onto a CDR. I have tried unsuccessfully both by using the encrypted file as the image file and also just burning the file onto a iso9660 filesystem. Oh and if anyone knows how to recover a reiserfs with the following error I would be really grateful. -debugreiserfs, 2001- reiserfsprogs 3.x.0j reiserfs_open: first bitmap looks corrupted Super block of format 3.6 found on the 0x3 in block 16 Block count 163840 Blocksize 4096 Free blocks 149868 Busy blocks (skipped 16, bitmaps - 5, journal blocks - 8193 1 super blocks, 5757 data blocks Root block 8214 Journal block (first) 18 Journal dev 0 Journal orig size 8192 Filesystem state VALID Tree height 3 Hash function used to sort names: r5 Objectid map size 18, max 972 Version 2 -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
