Re: Slightly OFF TOPIC - Traffic analysis...in reverse?
Charly Avital wrote: Hi, in the avalanche of news about the [recently] late Osama Bin Laden, I noticed a small item: the area where he was caught had been *also* defined/pinpointed by the lack of cellular phone communications. Among other anomalies at the compound: No cell traffic, no internet access, burning trash instead of putting it out for pickup, etc... -- John P. Clizbe Inet: John (a) Enigmail DAWT net FSF Assoc #995 / FSFE Fellow #1797 hkp://keyserver.gingerbear.net or mailto:pgp-public-k...@gingerbear.net?subject=HELP Q:Just how do the residents of Haiku, Hawai'i hold conversations? A:An odd melody / island voices on the winds / surplus of vowels signature.asc Description: OpenPGP digital signature ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: Slightly OFF TOPIC - Traffic analysis...in reverse?
John Clizbe wrote the following on 5/2/11 2:15 AM: Charly Avital wrote: Hi, in the avalanche of news about the [recently] late Osama Bin Laden, I noticed a small item: the area where he was caught had been *also* defined/pinpointed by the lack of cellular phone communications. Among other anomalies at the compound: No cell traffic, no internet access, burning trash instead of putting it out for pickup, etc... I heard later on about no internet access and burning trash. I also read that the compound was located in a densely populated, almost urban area. Maybe someone will learn from all this (if all this is genuine) that too much isolation will make you stand out. An an aside, and this is really off-topic, burning trash instead of putting out for pickup is a standard and careful procedure in areas where garbage pick up is not an alternative reliably available. To say the least. ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: Is the OpenPGP model still useful?
Simon Ward schrieb: On Fri, Apr 29, 2011 at 09:05:35PM +0200, B wrote: By the way: Using OpenPGP with enigmail in Thunderbird, I miss a feature: Usually the recipient rules work but if they fail (perhaps due to background update of Thunderbird and not working plugin), I would like to have a chance to see that the written message is going to be send unencrypted BEFORE sending. Or vice vera: I want to see that a instantly written message is going to be encrypted There is an option in Enigmail's expert settings to always confirm. Simon Hej Simon, thanks very much for your comment! I didn't know that setting yet. But I'm lacking phantasy of how to use this for preventing me of sending unencrypted in case that Enigmail does not work properly So, if it does not work, the confirmation request will not appear and mail goes out unencrypted, doesn't it? Regards, Boris ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: How to open Windows GPG encrypted files on Mac OS X
Alexander Willner wrote the following on 5/2/11 5:28 AM: From our point of view the issue lies in the TextWrangler code since it destructively modifies all files it opens. The user insightfulmac julioes...@gmail.com who originated the request in the gnupg-users list (How to open Windows GPG encrypted files on MacOSX), solved his problem using TextWrangler: After reviewing all answers, I have solved my problem! As Charly correctly pointed out, there is a slightly difference between TXT files from Mac OS X and Windows (basically Windows end-of-line is /R/F and Mac is /F)... As a newbie in Mac OS X, I didn't know that... The solution was to convert the Windows TXT file to the Mac OS X TXT format. Then, GPGServices worked perfectly! By the way: GPGServices is a very elegant solution! Better and simpler than all frontends I have used in order to decrypt files in Windows... I personally prefer BBEdit, but TextWrangler (released by the same software house) can also solve the issue of converting line ends, that was the problem of insightfulmac julioes...@gmail.com. Regards, Charly ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Offline Master Key
Hi, I have question on key management and was looking for some feedback. My issue is that I like the idea of having a Master signing key with no expiration date and I want to store this key offline without the inconvenience of using an offline computer every time i'd like to send a signed/encrypted message. My idea is to create a master signing key on an offline computer(persistent live usb). Then create two subkeys that have regular expiration dates. One encryption key and one additional daily-use signing key. I would post my master key in my signature and use it to sign the sub-keys. When sending mail I would use my daily use key to sign my messages. I would only access and use my master key when it is necessary to sign other keys and update my sub keys. Would this create any problems for those reading and verifying my emails? Would it be necessary to link to my key policy in my mail or would it be seamless that my sub signing key is valid because it is signed by the master. Thank you in advance for any help regarding my questions. I'm still new to gnupg, but I want to set it up right the first time. Patrick ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: Offline Master Key
Hi, * patric...@lavabit.com patric...@lavabit.com [110502 16:50, mID 7206.205.174.22.25.1304347651.squir...@lavabit.com]: Hi, I have question on key management and was looking for some feedback. My issue is that I like the idea of having a Master signing key with no expiration date and I want to store this key offline without the inconvenience of using an offline computer every time i'd like to send a signed/encrypted message. My idea is to create a master signing key on an offline computer(persistent live usb). Then create two subkeys that have regular expiration dates. One encryption key and one additional daily-use signing key. I would post my master key in my signature and use it to sign the sub-keys. When sending mail I would use my daily use key to sign my messages. I would only access and use my master key when it is necessary to sign other keys and update my sub keys. Would this create any problems for those reading and verifying my emails? Would it be necessary to link to my key policy in my mail or would it be seamless that my sub signing key is valid because it is signed by the master. If you follow the steps of the howto at [1] without using a smartcard (i.e. you don't move the subkeys to a OpenPGP card, but keep them in the keyring), this should work without problems. You can then sign and decrypt files with the subkeys (if you do it right, people will encrypt messages to the correct subkey *only*). [1] http://wiki.fsfe.org/Card_howtos/Card_with_subkeys_using_backups HTH Martin pgpyI3xccVju7.pgp Description: PGP signature ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: Offline Master Key
Am Montag, 2. Mai 2011, 16:47:31 schrieb patric...@lavabit.com: My idea is to create a master signing key on an offline computer(persistent live usb). Then create two subkeys that have regular expiration dates. One encryption key and one additional daily-use signing key. You can create the master key without any capability except for certification. It is theoretically possible to use several keys (main key and subkeys) within one key for signing and give the signatures different meanings (e.g. daily use vs. high security) but I think that most people would not notice the difference. So IMHO the only reason for having several simultaneously valid keys with the same ability in one key is compatibility: Use the strongest key (and have the others use it) whenever possible, otherwise use the worse fallback. I think it's a good idea to have signature and encryption keys of different quality but I would advice to use different main keys for that. That allows the others to understand the difference from a simple look at the UID (when using comments like daily use and high security). Would this create any problems for those reading and verifying my emails? No. Subkeys are a normal feature. The default configuration creates keys with a subkey (not for signing though). Nobody except you should be able to realize whether your master key is stored online or offline. Would it be necessary to link to my key policy in my mail No but it makes sense (independently of this question) to link it in your self-signature. See the option --set-policy-url though in the default configuration this URL is not shown (just hinted by a P). or would it be seamless that my sub signing key is valid because it is signed by the master. Yes, that's the concept of OpenPGP. Hauke -- PGP: D44C 6A5B 71B0 427C CED3 025C BD7D 6D27 ECCB 5814 signature.asc Description: This is a digitally signed message part. ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: Offline Master Key
On May 2, 2011, at 10:47 AM, patric...@lavabit.com wrote: Hi, I have question on key management and was looking for some feedback. My issue is that I like the idea of having a Master signing key with no expiration date and I want to store this key offline without the inconvenience of using an offline computer every time i'd like to send a signed/encrypted message. My idea is to create a master signing key on an offline computer(persistent live usb). Then create two subkeys that have regular expiration dates. One encryption key and one additional daily-use signing key. I would post my master key in my signature and use it to sign the sub-keys. When sending mail I would use my daily use key to sign my messages. I would only access and use my master key when it is necessary to sign other keys and update my sub keys. Would this create any problems for those reading and verifying my emails? No problems unless your correspondent is using a very old version of PGP that doesn't properly handle subkeys. I wouldn't worry about that too much in 2011. Would it be necessary to link to my key policy in my mail or would it be seamless that my sub signing key is valid because it is signed by the master. It should be seamless. This is a reasonably common thing to do. I do it myself, in fact. There is/was a HOWTO document for this method of handling keys written at one point. I can't seem to find the link at the moment, but if someone has it handy, please do post it. David ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: Slightly OFF TOPIC - Traffic analysis...in reverse?
| | in the avalanche of news about the [recently] late Osama Bin Laden, I | noticed a small item: the area where he was caught had been *also* | defined/pinpointed by the lack of cellular phone communications. | I do not send CallerID (well, you know that I do but you also know what I mean). As it happens, everyone I call assumes it is me as I am the only one who chooses that. --dan ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: Offline Master Key
On Mon, May 2, 2011 at 16:47, patric...@lavabit.com wrote: My idea is to create a master signing key on an offline computer(persistent live usb). Then create two subkeys that have regular expiration dates. One encryption key and one additional daily-use signing key. I would post my master key in my signature and use it to sign the sub-keys. When sending mail I would use my daily use key to sign my messages. I would only access and use my master key when it is necessary to sign other keys and update my sub keys. Would this create any problems for those reading and verifying my emails? If you are talking about actual sub-keys (not separate keys that are only semantically sub-keys), then there is no problem. However, they might have to get the latest key copy including the sub-keys to verify, and they definitely need the encryption sub-key to encrypt. Would it be necessary to link to my key policy in my mail or would it be seamless that my sub signing key is valid because it is signed by the master. An encryption sub-key is used to encrypt to the resp. uid on the master key. A signing sub-key is implied to belong to the same uid as well. So, it's seamless. -- Jerome Baum Telefon: +49-1578-8434336 E-Mail: jer...@jeromebaum.com -- PGP: A0E4 B2D4 94E6 20EE 85BA E45B 63E4 2BD8 C58C 753A PGP: 2C23 EBFF DF1A 840D 2351 F5F5 F25B A03F 2152 36DA ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: Offline Master Key
David Shaw wrote: There is/was a HOWTO document for this method of handling keys written at one point. I can't seem to find the link at the moment, but if someone has it handy, please do post it. Adrian von Bidder's How-To, http://fortytwo.ch/gpg/subkeys, comes to mind. It's linked on the GnuPG documentation How-To page, http://www.gnupg.org/documentation/howtos.en.html, but the actual page is 404. He was looking for someone to adopt the How-To back in 2006, but didn't receive a response on the list that I saw. Last crawl of the page at the WayBack Machine: http://replay.web.archive.org/20090609222126/http://fortytwo.ch/gpg/subkeys -John -- John P. Clizbe Inet: John (a) Enigmail DAWT net FSF Assoc #995 / FSFE Fellow #1797 hkp://keyserver.gingerbear.net or mailto:pgp-public-k...@gingerbear.net?subject=HELP Q:Just how do the residents of Haiku, Hawai'i hold conversations? A:An odd melody / island voices on the winds / surplus of vowels signature.asc Description: OpenPGP digital signature ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: Is the OpenPGP model still useful?
On Mon, May 2, 2011 at 5:34 AM, B brud...@cation.de wrote: Simon Ward schrieb: On Fri, Apr 29, 2011 at 09:05:35PM +0200, B wrote: By the way: Using OpenPGP with enigmail in Thunderbird, I miss a feature: Usually the recipient rules work but if they fail (perhaps due to background update of Thunderbird and not working plugin), I would like to have a chance to see that the written message is going to be send unencrypted BEFORE sending. Or vice vera: I want to see that a instantly written message is going to be encrypted There is an option in Enigmail's expert settings to always confirm. [SNIP] But I'm lacking phantasy of how to use this for preventing me of sending unencrypted in case that Enigmail does not work properly If you run your mail server, you should be able to set up a secure channel by having your MTA issue a STARTTLS command. The communication from the originating MTA to your MTA will be secure (some hand waiving). If the sender connects to his/her mail server securely (and MTA's use TLS), then most opportunities for message inspection and tampering should be remediated. Jeff ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: Is the OpenPGP model still useful?
Jeffrey Walton schrieb: On Mon, May 2, 2011 at 5:34 AM, B brud...@cation.de wrote: Simon Ward schrieb: On Fri, Apr 29, 2011 at 09:05:35PM +0200, B wrote: By the way: Using OpenPGP with enigmail in Thunderbird, I miss a feature: Usually the recipient rules work but if they fail (perhaps due to background update of Thunderbird and not working plugin), I would like to have a chance to see that the written message is going to be send unencrypted BEFORE sending. Or vice vera: I want to see that a instantly written message is going to be encrypted There is an option in Enigmail's expert settings to always confirm. [SNIP] But I'm lacking phantasy of how to use this for preventing me of sending unencrypted in case that Enigmail does not work properly If you run your mail server, you should be able to set up a secure channel by having your MTA issue a STARTTLS command. The communication from the originating MTA to your MTA will be secure (some hand waiving). If the sender connects to his/her mail server securely (and MTA's use TLS), then most opportunities for message inspection and tampering should be remediated. Hej Jeff, thanks for your comment! Your explanation has nothing to do with OpenPGP. Of course everybody could or should use TLS against his server Boris ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: Offline Master Key
On 5/2/11 12:13 PM, John Clizbe wrote: David Shaw wrote: There is/was a HOWTO document for this method of handling keys written at one point. I can't seem to find the link at the moment, but if someone has it handy, please do post it. Adrian von Bidder's How-To, http://fortytwo.ch/gpg/subkeys, comes to mind. It's linked on the GnuPG documentation How-To page, http://www.gnupg.org/documentation/howtos.en.html, but the actual page is 404. He was looking for someone to adopt the How-To back in 2006, but didn't receive a response on the list that I saw. Last crawl of the page at the WayBack Machine: http://replay.web.archive.org/20090609222126/http://fortytwo.ch/gpg/subkeys -John This link provides much more detailed instructions. Maybe this link can replace the fortytwo.ch page on the main site. http://tjl73.altervista.org/secure_keygen/en/index.html -- Grant I am gravely disappointed. Again you have made me unleash my dogs of war. signature.asc Description: OpenPGP digital signature ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Conditional options directives
I think this post falls under the heading of Feature Request, unless someone already knows how to accomplish the following. I think it would be useful if there was a way to format the GnuPG options file to conditionally apply options, depending on the key used (or potentially, depending upon the values of other variables, though key or user ID seem to be the most likely candidates). Let us suppose that we have more than one private key on our keychain. For this example, let's say we use one key to sign our personal email, and a different one to sign software packages we host on a company server. There may be settings in our gpg.conf file which should be different depending on the key we are using at the time. E.G. different URLs for retrieving keys, different comments, etc. This could be accomplished by saving different configuration files and specifying which one you want to use for any given operation with the --options flag, but wouldn't it be nice if the process could be automated? Not just nice, but much easier for other programs which interface with GnuPG, such as a mail plugin, for which there may be no convenient way to pass command line options. So, what I am thinking of is semantically a little like a pre-processor directive... #if (keyID == 123456) /* Use these options */ #elif (keyID == 789abc) /* Use some different options */ #else /* Fall back to a default set of options */ #endif Obviously it wouldn't look like that in the gpg.conf file, but the model of conditional compilation gets the point accross (I hope). Does anyone agree with me that this would be a good idea, or am I just crazy? Better yet, does anyone already implement some kind of conditional options parsing, using a technique which hasn't occured to me? -- Le hasard favorise l'esprit préparé. --Louis Pasteur pgpjyFPBgKNk5.pgp Description: PGP signature ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: Conditional options directives
On Mon, May 2, 2011 at 20:49, Kevin Kammer
lists.gn...@mephisto.fastmail.net wrote:
So, what I am thinking of is semantically a little like a pre-processor
directive...
#if (keyID == 123456)
/* Use these options */
#elif (keyID == 789abc)
/* Use some different options */
#else
/* Fall back to a default set of options */
#endif
Obviously it wouldn't look like that in the gpg.conf file, but the model of
conditional compilation gets the point accross (I hope).
Does anyone agree with me that this would be a good idea, or am I just
crazy? Better yet, does anyone already implement some kind of conditional
options parsing, using a technique which hasn't occured to me?
Sounds interesting. I would consider a kind of lookup sequence so you end
up with this:
.gnupg/
gnupg.conf
gnupg-key-01234567.conf
gnupg-key-0123456789abcdef.conf
etc.
That way, you can look at a single file to understand what will happen under
given circumstances, instead of having to parse through conditionals. I
don't think complicating the options format is a good idea. You end up with
stuff like this:
:(){ :|: };:
Of course, you should *not* run this code. It will crash your system. I am
just demonstrating that when you allow obfuscated meaning in data or code,
Mallory will trick you into configuring your gnupg to send out all your
private keys to her.
--
Jerome Baum
Telefon: +49-1578-8434336
E-Mail: jer...@jeromebaum.com
--
PGP: A0E4 B2D4 94E6 20EE 85BA E45B 63E4 2BD8 C58C 753A
PGP: 2C23 EBFF DF1A 840D 2351 F5F5 F25B A03F 2152 36DA
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: Syncing Keys between multiple computers?
Hi, On Mon, May 2, 2011 at 6:51 AM, John Clizbe j...@enigmail.net wrote: An alternate strategy is to use portable storage such as an USB memory stick or some other form of flash memory, and merge the keyring files onto that device and then point GnuPG to look there for keys by editing gpg.conf. A little bit off-topic but maybe encrypting that USB (using dm-crypt for e.g.) will add some extra security. -- Nguyễn Châu An || An NGUYEN Linux Technician FOSS Advocate --- OpenPGP KeyID 2048R/8F77A48C Key Fingerprint 7652 B403 749F F173 227D 4865 FB71 EC95 8F77 A48C ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: Is the OpenPGP model still useful?
On Mon, May 02, 2011 at 11:34:47AM +0200, B wrote: But I'm lacking phantasy of how to use this for preventing me of sending unencrypted in case that Enigmail does not work properly So, if it does not work, the confirmation request will not appear and mail goes out unencrypted, doesn't it? If Enigmail is completely broken, or you’ve disabled the add‐on, your emails will not be signed or encrypted and the confirmation request will not appear. In a non‐broken state with the confirmation option, the confirmation dialog appears every time you hit send, regardless of whether the mail is signed or encrypted, and informs you of the signing and encryption status. You might be able to verify yourself by choosing not to send the email immediately (send later), then inspecting the mail in the Outbox. I cannot remember if messages saved in the Outbox are encrypted. Simon -- A complex system that works is invariably found to have evolved from a simple system that works.—John Gall signature.asc Description: Digital signature ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: Conditional options directives
Kevin Kammer wrote: Let us suppose that we have more than one private key on our keychain. Safe bet. For this example, let's say we use one key to sign our personal email, and a different one to sign software packages we host on a company server. There may be settings in our gpg.conf file which should be different depending on the key we are using at the time. E.G. different URLs for retrieving keys, different comments, etc. This could be accomplished by saving different configuration files and specifying which one you want to use for any given operation with the --options flag, but wouldn't it be nice if the process could be automated? Doesn't a separate config file automate things? I fear you may be attempting to over-engineer a solution. Not just nice, but much easier for other programs which interface with GnuPG, such as a mail plugin, for which there may be no convenient way to pass command line options. To use your example, I know of two ways email plugins communicate with GnuPG: gpgme (Evolution, etc) or via some form of IPC (mozilla-mailnews/Enigmail, mutt). Neither seem to have much difficulty communicating additional (non-gpg.conf) options to gpg. So, what I am thinking of is semantically a little like a pre-processor directive... #if (keyID == 123456) /* Use these options */ #elif (keyID == 789abc) /* Use some different options */ #else /* Fall back to a default set of options */ #endif Obviously it wouldn't look like that in the gpg.conf file, but the model of conditional compilation gets the point across (I hope). I think the separate config file idea is superior. Does anyone agree with me that this would be a good idea, or am I just crazy? Better yet, does anyone already implement some kind of conditional options parsing, using a technique which hasn't occurred to me? Not a mental health professional, but I'd venture that whether or not you are crazy is orthogonal to whether this is a good idea, IMO, it isn't. I think it's an unnecessary complication and more attack/error prone. -- John P. Clizbe Inet: John (a) Enigmail FSF Assoc #995 / FSFE Fellow #1797 hkp://keyserver.gingerbear.net or mailto:pgp-public-k...@gingerbear.net?subject=HELP Q:Just how do the residents of Haiku, Hawai'i hold conversations? A:An odd melody / island voices on the winds / surplus of vowels signature.asc Description: OpenPGP digital signature ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
