Problems invoking gpgsm with curses interface.
Hello, Gnupg has s/MIME component to manage x509 certificate, which is called gpgsm. Running gpgsm with a working desktop such as KDE is fine. But when I'm running it on a shell, using pinentry-curses as passphrase input backend, I got an error saying that LC-CTYPE is unknown. gpgsm: pinentry-curses: no LC_CTYPE known - assuming UTF-8 I've set GPG_TTY environment variable and started gpg-agent as daemon. For your information, I run gpgsm to import a p12 certificate `gpgsm --import mycert.p12` Is there any workaround to fix this strange gpgsm behavior? Thanks. pgpV1OM6eZDL8.pgp Description: PGP signature ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Automatic e-mail encryption
On 19/07/14 00:34, Ingo Klöcker wrote: Sure. But the NSA already knows the correspondents of all of our mail anyway. Keyserver lookups do not add any additional data Pssh. What an argument. Please refrain from such useless rhetorics. But the keyserver (owner) has to be trustworthy anyway. First of all, trustworthy is a really ill-defined notion. Should I give them my credit card? Secondly: why? Why does a keyserver need to be trustworthy? In fact, why do I even need a keyserver? It's a convenience. But I can just exchange keys with my peers. I don't need to trust any keyserver operator. Unless it is silently done behind my back, that is. Here's an idea: when elliptic curve becomes ubiquitous, simply include your public key in the header of every e-mail you send. That's way closer to how SSH works, since it uses only one channel, in this case the e-mails themselves. Perhaps it would be a good idea to only include the actual EC public key, and not the whole OpenPGP packet, to keep it small. You say signing isn't covered... I don't see why not. Just as you automatically decrypt; automatically sign. There still is the large issue of private key distribution. I have several machines all connected to my e-mail account. It seems to me there's a *lot* of infrastructure still missing for this to be almost transparent to the end-user. This topic, if discussed at all, should be discussed by itself and not as some kind of counter-offer to symmetric encryption, because the problem space is vastly different. By the way: if we had a working alternative to SSL/TLS, all the mail servers could talk to eachother securely without eavesdropping. That way the contents of e-mails is only exposed on the sending SMTP server and the receiving SMTP and mailbox servers (f.e., IMAP). The mailbox server already knows when you use automatic decryption to facilitate searching, and the receiving SMTP server is probably under the control of the same people that control the receiving mailbox server. So they are probably about equally difficult to access. And likewise, the sender will have a decrypted copy in his Sent folder on his mailbox server, and the sending SMTP server is again close to that server. So if only we had a way to properly authenticate SMTP servers, I think we get almost the same effective protection for the users, albeit without signatures. And this requires only changes to a couple of servers, instead of to all endpoints. HTH, Peter. -- I use the GNU Privacy Guard (GnuPG) in combination with Enigmail. You can send me encrypted mail if you want some privacy. My key is available at http://digitalbrains.com/2012/openpgp-key-peter ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Fwd: [Enigmail] [ANN] Enigmail v1.7 available
As there are many Enigmail users who read this list, but not [Enigmail], I'm
forwarding the announcement of the newest release of Enigmail, v1.7.
There are quite a few changes in this release.
As Patrick writes in the announcement:
As usually, it will take up to two weeks until the version will be
available from addons.mozilla.org.
Until then, Enigmail 1.7 may be obtained two ways:
1) From https://addons.mozilla.org/en-US/thunderbird/addon/enigmail/
Until the AMO staff finish their review, new versions will be available only
from Version History list ('View other versions' link below-right from the
Download button).
2) Visit the Enigmail project's download page and download from there.
https://www.enigmail.net/download/
Debian/Ubuntu users will need to wait until Enigmail 1.7 has been packaged for
your use.
There will no doubt be support questions. The BEST, and recommended, place to
address them is the Enigmail mailing list:
enigmail-users mailing list
enigmail-us...@enigmail.net
To unsubscribe or make changes to your subscription click here:
https://admin.hostpoint.ch/mailman/listinfo/enigmail-users_enigmail.net
The list is moderated to reduce SPAM. Subscribe if you do not with to wait in
the moderation queue
Forwarded Message
Subject: [Enigmail] [ANN] Enigmail v1.7 available
Date: Sat, 12 Jul 2014 18:20:56 +0200
From: Patrick Brunschwig patr...@enigmail.net
Reply-To: Enigmail user discussion list enigmail-us...@enigmail.net
To: Enigmail user discussion list enigmail-us...@enigmail.net
I'm happy to announce the availability of Enigmail v1.7 for
Thunderbird 24 - 31, and SeaMonkey 2.20 and newer.
This version brings many new features (special thanks to Nico
Josuttis!) plus a lot bug fixes. Furthermore, this version ensures
compatibility with the upcoming releases of Thunderbird and SeaMonkey.
Notable Changes
===
* New convenience mode for sending mails
* Automatic encryption if all keys are known
* More intuitive view of encryption/signing states in icons and menus
* Possibility to filter in the key selection dialog
* Better selection options for importing keys from address book
* Menu items and labels were changed from OpenPGP to Enigmail
* Better algorithm for selecting best key for an email address
* More fine-grained options for displaying dialog before message sending
* Better fault tolerance at many places
* Some support for PGP/MIME mails deformed by Exchange servers
Obtaining Enigmail
==
Enigmail can be downloaded from
https://www.enigmail.net/download/index.php
The changelog is available from
https://www.enigmail.net/download/changelog.php
As usually, it will take up to two weeks until the version will be
available from addons.mozilla.org.
-Patrick
___
enigmail-users mailing list
enigmail-us...@enigmail.net
To unsubscribe or make changes to your subscription click here:
https://admin.hostpoint.ch/mailman/listinfo/enigmail-users_enigmail.net
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: symmetric email encryption
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi On Friday 18 July 2014 at 8:23:08 PM, in mid:20140718192308.47a05a0...@smtp.hushmail.com, ved...@nym.hush.com wrote: The only annoyance with this type of approach, is that it needs a separate passphrase for each correspondent, How? Running gpg --symmetric test.txt only gives me the opportunity to enter one passphrase for the encryption. Hushmail has a one-way variant of this approach. [snipped] The receiver gets a message that an encrypted e-mail has been sent, and is directed to the Hushmail server where the sender's question is asked, and the receiver has 3 chances to provide the correct answer. A correct answer decrypts the symmetrically encrypted e-mail and the plaintext is displayed on the Hushmail server. The e-mail is removed from the server after 72 hours. It is a good idea to tell the recipient in advance. Otherwise they just see yet another unsolicited email suggesting to follow a link or visit an unfamiliar website. - -- Best regards MFPAmailto:2014-667rhzu3dc-lists-gro...@riseup.net Don't cry because it is over - smile because it happened -BEGIN PGP SIGNATURE- iPQEAQEKAF4FAlPKgS5XFIAALgAgaXNzdWVyLWZwckBub3RhdGlvbnMub3Bl bnBncC5maWZ0aGhvcnNlbWFuLm5ldEJBMjM5QjQ2ODFGMUVGOTUxOEU2QkQ0NjQ0 N0VDQTAzAAoJEKipC46tDG5pXkgD/j3s56ApdFNwcjFY3SREkocyGxXGDtONA8Z4 nYeO60nOP3w95+p9t49aBfKxNTjoaix3MwlAzSbvtr8JU+0ZoiAZ6Kmlg88eLYYm Zbt2eQqIpqwPhZjBCe9p2ZyTKW5gBnVSbYIZpB7Wj5fle+RoRpJHMMogjmhakdlc YGmDRaVH =8lgV -END PGP SIGNATURE- ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: symmetric email encryption
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi On Saturday 19 July 2014 at 4:41:10 AM, in mid:53c9e8d6.4010...@riseup.net, Mirimir wrote: I just emailed that to myself using Thunderbird + Enigmail in Ubuntu. I was prompted for a password, and foo decrypted the symmetrically encrypted block. I did a similar thing and my email program prompted me to Input OpenPGP key passphrase for unknown recipient. Mine decrypted OK, as well. If I encrypt it to my key as well as to a passphrase, it does not list unknown recipient among the passphrase entry options, but does encrypt with the test passphrase as well as with my key. As an aside, the gui frontend I use for key management has a current window or clipboard encrypt function, which allows to add symmetrical by ticking a box (and prompting to enter the passphrase twice). - -- Best regards MFPAmailto:2014-667rhzu3dc-lists-gro...@riseup.net She looked like butter wouldn't melt in her mouth - or anywhere else. -BEGIN PGP SIGNATURE- iPQEAQEKAF4FAlPKht5XFIAALgAgaXNzdWVyLWZwckBub3RhdGlvbnMub3Bl bnBncC5maWZ0aGhvcnNlbWFuLm5ldEJBMjM5QjQ2ODFGMUVGOTUxOEU2QkQ0NjQ0 N0VDQTAzAAoJEKipC46tDG5pR+oD/jOiZ9BXJ8AuOrFkVU90FU+OaXAcr3Oq5lwv ThRMsX7YqXGntJ4etopopt90yPc93iDLpIJJpFjtS4uYbdEN4IozyJQiBUeeERHL 70ziw6aOpo78XykP6TuplNxpZ+1DlAP1LsAN8iXs1ei5Zne/I3dmcKNbqLzhbvtL hfypitfs =C7J1 -END PGP SIGNATURE- ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: symmetric email encryption
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi On Friday 18 July 2014 at 11:34:19 PM, in mid:1460534.5jfkcsu...@thufir.ingo-kloecker.de, Ingo Klöcker wrote: Sure. But the NSA already knows the correspondents of all of our mail anyway. Keyserver lookups do not add any additional data (except of the information that you are trying to look up a key resp. that you are talking to a keyserver). Time of use is a big piece of information that a keyserver lookup could add. And, maybe, IP address, operating system, software... Good point. Automatic decryption should be possible for those that want it. My scheme is mostly meant as in-transit encryption which again is way better than our current status quo. And the choice whether to store their emails encrypted or decrypted. Storing decrypted could be an issue, especially if the emails are stored on a server rather than the user's machine. Peter Lebbing wrote: An e-mail system with a default big usability issue will get swapped out for a more pleasant to use one. It might, but Outlook is in widespread use despite major usability issues. Peter Lebbing wrote: Finally, I think people might take issue with their e-mail address automatically being posted to a public keyserver. A certain minority would take exception to this, including myself. It is less of a problem for me with the automatic upload of just a single email address per key and no name/identity information. How exactly does one harvest email addresses from the keyservers? Can I ask keyservers to give me all keys it has in storage? Or do I need to search for keys matching a certain substring? I honestly don't know. Anyway, if this really becomes a problem than key lookup probably needs to be made as inconvenient as trying to send email probes to randomly generated email addresses. Isn't key lookup already more inconvenient than randomly generating email addresses? Or have I missed something? For my scheme to work the keyservers would only need to return keys where the email address part of a uid exactly matches the recipient's email address. The email address could be hashed in the key UID that's automatically uploaded... Moreover, for my scheme to work no key certification is necessary, i.e. crawling from one key to the next via certification signatures wouldn't be possible. Some people have specific use cases where key certification is needed. But most email communication doesn't have a way of being sure who controls the address. The scheme has more issues: For example, there's no message integrity protection (via signing) whatsoever. There's no reason not to have it. - -- Best regards MFPAmailto:2014-667rhzu3dc-lists-gro...@riseup.net Live your life as though every day it was your last. -BEGIN PGP SIGNATURE- iPQEAQEKAF4FAlPKlAZXFIAALgAgaXNzdWVyLWZwckBub3RhdGlvbnMub3Bl bnBncC5maWZ0aGhvcnNlbWFuLm5ldEJBMjM5QjQ2ODFGMUVGOTUxOEU2QkQ0NjQ0 N0VDQTAzAAoJEKipC46tDG5pFTIEAJ1acb0+CvHLkAuCtqnTed1L6v8xsvbvbNXz TS8oaZ7cCzBo9PK3nllDl1AM/qw4tpopLpwNH5H3ByjrzrPZjyonV8bSZoyFffwd U+hhSeaPEFI5Ox5pAdtnb3Mu0troNatcnKAdbgdykMlwsyEy0ez48qWeudlRy0Nr xiBR99za =wmKi -END PGP SIGNATURE- ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: symmetric email encryption
A factor of two is immense to you...? Yes. A secret that only I know I can keep; a secret known to two people can only be kept for a while. Yes, that's an immense difference. ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: symmetric email encryption
On Saturday 19 July 2014 03:46:56 Hauke Laging wrote: I guess this discussion does not go well because of a misunderstanding or wrong expectations. You and Ingo are talking about real crypto issues. Actually, concerning your proposal, I'm more talking about usability. To encrypt a message using your proposal the sender needs to * write the message, * tell his mail client that he wants to encrypt the message, * come up with and enter the password that should be used for encrypting the message, (- minor inconvenience) * tell the recipient the password, (- major inconvenience) * and, finally, send the message. That's three more steps than for sending an unencrypted message. And for one of those steps a completely different communication channel needs to be used. This is so inconvenient that I cannot see this helping our cause. Regards, Ingo signature.asc Description: This is a digitally signed message part. ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: Automatic e-mail encryption
Hi Peter, please do not send me direct replies. I am subscribed so reply-to-list is sufficient. (I wouldn't ask this of you if I'd receive two copies of your replies, but I only receive the direct replies and this means I cannot use reply-to-list. The mailing list is correctly configured, so I blame a fancy deduplication feature of the receiving Exchange mail server.) On Saturday 19 July 2014 14:26:44 Peter Lebbing wrote: Here's an idea: when elliptic curve becomes ubiquitous, simply include your public key in the header of every e-mail you send. That's way closer to how SSH works, since it uses only one channel, in this case the e-mails themselves. Perhaps it would be a good idea to only include the actual EC public key, and not the whole OpenPGP packet, to keep it small. I like this idea. You say signing isn't covered... I don't see why not. Just as you automatically decrypt; automatically sign. It doesn't feel right to automatically sign messages with automatically created keys. Also, signing is irrelevant for my use case: end-to-end encryption. There still is the large issue of private key distribution. I have several machines all connected to my e-mail account. It seems to me there's a *lot* of infrastructure still missing for this to be almost transparent to the end-user. Yeah. Usage of multiple machines/devices is an unsolved problem. This topic, if discussed at all, should be discussed by itself and not as some kind of counter-offer to symmetric encryption, because the problem space is vastly different. Right. I guess I simply grabbed the opportunity. By the way: if we had a working alternative to SSL/TLS, all the mail servers could talk to eachother securely without eavesdropping. That way the contents of e-mails is only exposed on the sending SMTP server and the receiving SMTP and mailbox servers (f.e., IMAP). The mailbox server already knows when you use automatic decryption to facilitate searching, unless the decrypted messages are only stored locally. Yes, this would break server-side searching and is problematic on devices with limited storage capacity. and the receiving SMTP server is probably under the control of the same people that control the receiving mailbox server. So they are probably about equally difficult to access. And likewise, the sender will have a decrypted copy in his Sent folder on his mailbox server, unless ... and the sending SMTP server is again close to that server. So if only we had a way to properly authenticate SMTP servers, I think we get almost the same effective protection for the users, albeit without signatures. And this requires only changes to a couple of servers, instead of to all endpoints. Good news: I think we do have such a way. It's called DANE (DNS-based Authentication of Named Entities) [1]. Support for DANE has been added to Postfix a few months ago and a few German mail providers recently started using it. Regards, Ingo [1] https://tools.ietf.org/html/rfc6698 signature.asc Description: This is a digitally signed message part. ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: symmetric email encryption
On Saturday 19 July 2014 04:37:56 Hauke Laging wrote: Am Sa 19.07.2014, 01:42:19 schrieb Ingo Klöcker: Since you are also using KMail I invite you to test whether KMail is able to decrypt symmetrically encrypted OpenPGP/MIME messages out-of-the-box. It might just work, but I'm too lazy and too tired to test this right now. It does work. It seems not to work with Thunderbird/Enigmail though. But maybe I have done something wrong. The Enigmail console output looks good to me... I have prepared a mail file for those who want to give this a try: http://www.crypto-fuer-alle.de/docs/mail-symmetric/mail.cr-lf.eml Thanks for testing (also to Mirimir and MFPA). And what's your threat model, i.e. what do you want to achieve by your symmetric email encryption scheme? Same answer: This is for users who don't need any threat model consideration. Huh? Why would those users want to encrypt a message if they don't have a threat in mind? I'm not replying to anything else because I think I have nothing more to add. Regards, Ingo signature.asc Description: This is a digitally signed message part. ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: symmetric email encryption
Am Sa 19.07.2014, 22:37:24 schrieb Ingo Klöcker: And what's your threat model, i.e. what do you want to achieve by your symmetric email encryption scheme? Same answer: This is for users who don't need any threat model consideration. Huh? Why would those users want to encrypt a message if they don't have a threat in mind? I guess the typical case would be that either the sender or the recipient wants the communication encrypted (probably uses real crypto himself) and would use symmetric encryption as the fastest and easiest way to enable the other one to do that (or the only way the other party accepts at that moment). Furthermore: Usually when people start using a new tool or new technology they don't use it right. Probably at least 90% of the OpenPGP users use OpenPGP in a way I would not consider good. They do it because it's OK for them. They probably haven't put much consideration into that – as you have to know a lot about the area to make these considerations. Noone cares about that with normal crypto. Why should this be a hard criterion in this case? I haven't seen the new Enigmail 1.7 yet but the default settings of 1.6 are a nightmare. GPGTools takes worst practice to a new level by doing the same like Enigmail – but without the (easy to find?) option to change it. And even more showing off on the bad side: Certifying keys *without* showing the fingerprint! GnuPG doesn't tell you at which (maximum) level a certain key has been signed. There is no transparency in authenticity, no transparency in key security (part of that: no transparency about PC security, see (German) http://www.crypto-fuer-alle.de/wishlist/securitylevel/), no trancparency in key usage, the current WoT is crap because it offers nearly none of the information you need... That is the current crypto reality. And people are talking about security problems and thread models for symmetric encryption, fighting for good crypto usage? Really? Hauke -- Crypto für alle: http://www.openpgp-schulungen.de/fuer/unterstuetzer/ http://userbase.kde.org/Concepts/OpenPGP_Help_Spread OpenPGP: 7D82 FB9F D25A 2CE4 5241 6C37 BF4B 8EEF 1A57 1DF5 signature.asc Description: This is a digitally signed message part. ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: symmetric email encryption
I guess the typical case would be that either the sender or the recipient wants the communication encrypted (probably uses real crypto himself) and would use symmetric encryption as the fastest and easiest way to enable the other one to do that (or the only way the other party accepts at that moment). When technically savvy people make guesses about the typical use case, we are usually wrong on levels we don't even imagine. This is why real usability studies with real users are essential. At any rate, no one is telling you that you can't do this. All you've heard is that you've not convinced other people to implement it for you. The GnuPG and Enigmail sources are both freely available: start hacking. If you're right and people start using this in droves, I'll cheerfully be the first one to admit I was wrong. With this, I'm out of this thread. :) ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: symmetric email encryption
On Sat, Jul 19, 2014 at 01:55:45PM -0400, Robert J. Hansen wrote: A factor of two is immense to you...? Yes. A secret that only I know I can keep; a secret known to two people can only be kept for a while. Yes, that's an immense difference. Old Hell's Angels saying, 3 people can keep a secret if two of them are dead. Not a very sophisticated bunch but.. ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users -- Bob Holtzman A man is a man who will fight with a sword or tackle Mt Everest in snow, but the bravest of all owns a '34 Ford and tries for 6000 in low. signature.asc Description: Digital signature ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: Fwd: [Enigmail] [ANN] Enigmail v1.7 available
On 07/19/2014 09:29 AM, John Clizbe wrote: Debian/Ubuntu users will need to wait until Enigmail 1.7 has been packaged for your use. Enigmail 1.7 is already packaged and present in debian unstable and debian testing. I'll look into backporting it to debian stable later this week. --dkg signature.asc Description: OpenPGP digital signature ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
