Re: Certified OpenPGP-encryption after release of Thunderbird 78

[charlie derr]

On 5/29/20 7:39 PM, Grzegorz Kulewski wrote:
> Time to check Claws I think.

i've found that claws, evolution, sylpheed and kmail all integrate
seamlessly with gpg2 (using standard debian packages for everything)

   ~c

-- 
Charlie Derr   Director, Instructional Technology 413-528-7344
https://www.simons-rock.edu Bard College at Simon's Rock
Encryption key: http://hope.simons-rock.edu/~cderr/
Personal writing: https://medium.com/@cderr
pronouns: either he/him or they/them is acceptable
Home landline: 860-435-1427

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Certified OpenPGP-encryption after release of Thunderbird 78

[Robert J. Hansen]

> I wasn't asking if GUI is acceptable. I was asking if crypto and GUI
> happen in the same process (the main TB process). Since they seem to
> be using a library for PGP it's quite probable. And if so - is that
> acceptable in your opinion?

Oh!  When you said "process", I read that as "workflow".  My apologies.
 Yes, it's all part of the main family of processes.  There's no
spawning off of a GnuPG instance and setting up a communications channel
to it.

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Certified OpenPGP-encryption after release of Thunderbird 78

[Grzegorz Kulewski]

W dniu 30.05.2020 o 01:26, Robert J. Hansen pisze:
>> 1. Will key management and crypto happen in the same process as
>> IMAP/POP/SMTP, GUI, JavaScript and everything else? If so - do you
>> believe it's acceptable?
> 
> It should be an easy learning curve for Enigmail users.  That isn't the
> same as finding it acceptable, though.
> 
> Back in the mid-'90s PGP came out with a GUI for PGP 5, and it's
> universally agreed at user interface was horrific.  (See "Why Johnny
> Can't Encrypt" for a detailed teardown.)  The problem was that this
> horrific user interface became the standard user interface, and most
> OpenPGP key managers ever since have adopted it.  Those that haven't
> adopted it, nobody uses, because their UI is so different than
> everything else.

I wasn't asking if GUI is acceptable. I was asking if crypto and GUI happen in 
the same process (the main TB process). Since they seem to be using a library 
for PGP it's quite probable. And if so - is that acceptable in your opinion?


>> 2. Is there any real plan to have working smartcard support in the
>> near future?
> 
> No.  There's some talk about supporting it, but as far as I know there's
> no plan to do it.  It's still at the "you know, it'd be kind of nice
> if..." stage, not the "we really should do this" stage.

Double nice.

Time to check Claws I think.

-- 
Grzegorz Kulewski
g...@leniwiec.biz
+48 663 92 88 95

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Certified OpenPGP-encryption after release of Thunderbird 78

[Robert J. Hansen]

> 1. Will key management and crypto happen in the same process as
> IMAP/POP/SMTP, GUI, JavaScript and everything else? If so - do you
> believe it's acceptable?

It should be an easy learning curve for Enigmail users.  That isn't the
same as finding it acceptable, though.

Back in the mid-'90s PGP came out with a GUI for PGP 5, and it's
universally agreed at user interface was horrific.  (See "Why Johnny
Can't Encrypt" for a detailed teardown.)  The problem was that this
horrific user interface became the standard user interface, and most
OpenPGP key managers ever since have adopted it.  Those that haven't
adopted it, nobody uses, because their UI is so different than
everything else.

> 2. Is there any real plan to have working smartcard support in the
> near future?

No.  There's some talk about supporting it, but as far as I know there's
no plan to do it.  It's still at the "you know, it'd be kind of nice
if..." stage, not the "we really should do this" stage.


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Certified OpenPGP-encryption after release of Thunderbird 78

[Grzegorz Kulewski]

W dniu 30.05.2020 o 01:07, Robert J. Hansen pisze:
>> If TB 78 is going to have native support of openGPG encryption, then the
>> original person in the thread should be able to export all of the keys
>> in their key rings, and import all of those keys into TB 78, or am I
>> missing one of the gotchas with
>> TV 78 and it's openGPG encryption support.
> 
> You're missing the gotcha of "as of -Beta3, the new Thunderbird *cannot
> even import a key*."
> 
> I'm not kidding.  It is so far from complete that Kai Englert, who leads
> the TB78 OpenPGP effort, recently proposed postponing OpenPGP support in
> TB until version 78.2, or about a three-month delay.
> 
> At present, as of -Beta3, TB78's OpenPGP support is badly broken.

Nice.

Since you seem to be following OpenPGP-in-TB78 development:
1. Will key management and crypto happen in the same process as IMAP/POP/SMTP, 
GUI, JavaScript and everything else? If so - do you believe it's acceptable?
2. Is there any real plan to have working smartcard support in the near future?

-- 
Grzegorz Kulewski


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Certified OpenPGP-encryption after release of Thunderbird 78

[Robert J. Hansen]

> If TB 78 is going to have native support of openGPG encryption, then the
> original person in the thread should be able to export all of the keys
> in their key rings, and import all of those keys into TB 78, or am I
> missing one of the gotchas with
> TV 78 and it's openGPG encryption support.

You're missing the gotcha of "as of -Beta3, the new Thunderbird *cannot
even import a key*."

I'm not kidding.  It is so far from complete that Kai Englert, who leads
the TB78 OpenPGP effort, recently proposed postponing OpenPGP support in
TB until version 78.2, or about a three-month delay.

At present, as of -Beta3, TB78's OpenPGP support is badly broken.


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Certified OpenPGP-encryption after release of Thunderbird 78

[Barry Smith via Gnupg-users]

Robert.
I am a long-time version of many different versions of Thunderbird,
enigmail, and multiple packages of gpg.

If TB 78 is going to have native support of openGPG encryption, then the
original person in the thread should be able to export all of the keys in
their key rings, and import all of those keys into TB 78, or am I missing
one of the gotchas with
TV 78 and it's openGPG encryption support.

On Fri, May 29, 2020, 17:35 Robert J. Hansen  wrote:

> > Since you mention that you did support for Enigmail, do you have also
> > infos about the current status of Thunderbird development, i.e.
> > beta testing etc., regarding OpenPGP support, so that you may can tell
> > us what people can expect?
>
> Enigmail development has ended.  The upcoming 2.2 is the final release
> and introduces no new features.  It exists only to help people migrate
> to TB78's OpenPGP support.
>
> TB68 is being EOLed this fall.  We've promised to continue to support
> users for six months after that, including giving emergency security
> fixes to Enigmail if they become necessary: but at six months and one
> day we're going to mop the floor, tally up the cash register, shut off
> the lights, and lock up as we leave.
>
> (The only exception is a commercial email company that has a signed
> support contract with Patrick -- their contract will be fulfilled.)
>
> ___
> Gnupg-users mailing list
> Gnupg-users@gnupg.org
> http://lists.gnupg.org/mailman/listinfo/gnupg-users
>
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Certified OpenPGP-encryption after release of Thunderbird 78

[Stefan Claas]

Robert J. Hansen wrote:
 
> > Since you mention that you did support for Enigmail, do you have
> > also infos about the current status of Thunderbird development, i.e.
> > beta testing etc., regarding OpenPGP support, so that you may can
> > tell us what people can expect?
> 
> Enigmail development has ended.  The upcoming 2.2 is the final release
> and introduces no new features.  It exists only to help people migrate
> to TB78's OpenPGP support.
> 
> TB68 is being EOLed this fall.  We've promised to continue to support
> users for six months after that, including giving emergency security
> fixes to Enigmail if they become necessary: but at six months and one
> day we're going to mop the floor, tally up the cash register, shut off
> the lights, and lock up as we leave.
> 
> (The only exception is a commercial email company that has a signed
> support contract with Patrick -- their contract will be fulfilled.)

Thanks for the info, much appreciated.

Regards
Stefan

-- 
my 'hidden' service gopherhole:
gopher://iria2xobffovwr6h.onion

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Certified OpenPGP-encryption after release of Thunderbird 78

[Robert J. Hansen]

> Since you mention that you did support for Enigmail, do you have also
> infos about the current status of Thunderbird development, i.e.
> beta testing etc., regarding OpenPGP support, so that you may can tell
> us what people can expect?

Enigmail development has ended.  The upcoming 2.2 is the final release
and introduces no new features.  It exists only to help people migrate
to TB78's OpenPGP support.

TB68 is being EOLed this fall.  We've promised to continue to support
users for six months after that, including giving emergency security
fixes to Enigmail if they become necessary: but at six months and one
day we're going to mop the floor, tally up the cash register, shut off
the lights, and lock up as we leave.

(The only exception is a commercial email company that has a signed
support contract with Patrick -- their contract will be fulfilled.)

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Certified OpenPGP-encryption after release of Thunderbird 78

[Mark]

One of the potential problems I can see is multiple key rings. which I
have just recently discovered in my own setup. I have the "standard" key
rings that GPG4Win/Enigmail use and then I discovered 2 unknown files in
my gnupg directory. PAPubring.gpg and PAsecring.gpg. I eventually
deduced they came from an archiving program I use that has PGP built in
called Power Archiver. 

Granted I am a newbie with PGP but the thought of having to make sure
multiple key rings are all synced sounds like a hassle.


On 5/29/2020 1:32 PM, Robert J. Hansen wrote:
>>> But it's a pity that
>>> Thunderbird developed its own solution because of licensing issues
>>> while we have a proven working solution with GnuPG...
>> We never know, maybe in the future someone writes again a fully working
>> solution for Thunderbird/GnuPG users.
> Over the last fifteen years of providing email support to Enigmail
> users, I can say 95% of the Enigmail problems were caused by needing to
> call out to GnuPG.  The pipeline was (still is) fragile and the source
> of many errors.  Distributing GnuPG separately from Enigmail was also a
> headache and a half.
>
> You may think Enigmail is a proven working solution because it works for
> you and the people you know.  I'm very happy it works so well for you!
> But from my perspective, with literally almost two thousand emails over
> the last fifteen years from people asking for help, I'm reluctant to
> call it that.
>
> It works well for many people and I'm really glad it exists.  But
> there's still an unfortunate amount of work involved in getting it set
> up and working.
>
> ___
> Gnupg-users mailing list
> Gnupg-users@gnupg.org
> http://lists.gnupg.org/mailman/listinfo/gnupg-users

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Certified OpenPGP-encryption after release of Thunderbird 78

[Stefan Claas]

Robert J. Hansen wrote:
 
> >> But it's a pity that
> >> Thunderbird developed its own solution because of licensing issues
> >> while we have a proven working solution with GnuPG...
> > 
> > We never know, maybe in the future someone writes again a fully
> > working solution for Thunderbird/GnuPG users.  
> 
> Over the last fifteen years of providing email support to Enigmail
> users, I can say 95% of the Enigmail problems were caused by needing
> to call out to GnuPG.  The pipeline was (still is) fragile and the
> source of many errors.  Distributing GnuPG separately from Enigmail
> was also a headache and a half.
> 
> You may think Enigmail is a proven working solution because it works
> for you and the people you know.  I'm very happy it works so well for
> you! But from my perspective, with literally almost two thousand
> emails over the last fifteen years from people asking for help, I'm
> reluctant to call it that.
> 
> It works well for many people and I'm really glad it exists.  But
> there's still an unfortunate amount of work involved in getting it set
> up and working.

I can only say from my side, when using Enigmail many moons ago, with
a Mac, it was ok.

Since you mention that you did support for Enigmail, do you have also
infos about the current status of Thunderbird development, i.e.
beta testing etc., regarding OpenPGP support, so that you may can tell
us what people can expect?

Regards
Stefan

-- 
my 'hidden' service gopherhole:
gopher://iria2xobffovwr6h.onion

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Certified OpenPGP-encryption after release of Thunderbird 78

[Robert J. Hansen]

>> But it's a pity that
>> Thunderbird developed its own solution because of licensing issues
>> while we have a proven working solution with GnuPG...
> 
> We never know, maybe in the future someone writes again a fully working
> solution for Thunderbird/GnuPG users.  

Over the last fifteen years of providing email support to Enigmail
users, I can say 95% of the Enigmail problems were caused by needing to
call out to GnuPG.  The pipeline was (still is) fragile and the source
of many errors.  Distributing GnuPG separately from Enigmail was also a
headache and a half.

You may think Enigmail is a proven working solution because it works for
you and the people you know.  I'm very happy it works so well for you!
But from my perspective, with literally almost two thousand emails over
the last fifteen years from people asking for help, I'm reluctant to
call it that.

It works well for many people and I'm really glad it exists.  But
there's still an unfortunate amount of work involved in getting it set
up and working.

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: libgcrypt: random source via library on Linux?

[Steffen Nurpmeso]

Hello Werner, all.

Steffen Nurpmeso wrote in
<20200529155411.tgyu1%stef...@sdaoden.eu>:
 |Werner Koch wrote in
 |<87sgfjrqf1@wheatstone.g10code.de>:
 ||On Thu, 28 May 2020 14:43, Steffen Nurpmeso said:
 ...
 |out for NAME_OF_DEV_*RANDOM at all .. hmm .. i must admit
 |random/rndlinux.c:_gcry_rndlinux_gather_random() seems strange to
 |me.  :)  Two possible calls to getpid, could be "((apid = XPID) !=
 ...
 |I still would not do it like that, because if software cannot rely
 ...
 |Anyhow, unless i am mistaken from this five minute looking, that
 |random/random-csprng.c:getfnc_gather_random()
 |
 |  #if USE_RNDLINUX
 |if ( !access (NAME_OF_DEV_RANDOM, R_OK)
 | && !access (NAME_OF_DEV_URANDOM, R_OK))
 |  {
 |fnc = _gcry_rndlinux_gather_random;
 |return fnc;
 |}
 |  #endif
 |
 |i would change, maybe with a new call-in to rndlinux.c which
 |should be made responsible for Linux-only environmental detections
 |imho.  Like that it could solely depend on getrandom, and make all
 |the FDs optional, maybe by testing for NOSYS with a one byte read
 |or what at first, or by later aborting if collecting random fails
 |if that is possible.  (For my MUA i use this for seeding only
 |anyhow.)
 |
 ||Are you running in FIPS mode?
 ||
 ||Can you run the Libgcrypt test suite?  In particular
 ||
 ||$ libgcrypt/tests/version
 ||$ libgcrypt/tests/random --verbose --debug

So with the attached patch libgcrypt solely relies upon getentropy
if available, no FD handling is done no more if at all possible.
The test suite passes, a short review makes me think it is alright.

- The setup could block when the OS cannot serve 1 byte of strong
  entropy.  This is different to before, access(2) does not.

  (On the other hand neither on OpenBSD nor on newer Linux (5.4 or
  5.6 i think) this should matter.  And it is likely it does not
  elsewhere, either people seem to have used things like my
  entropy-saver or even hammers like haveged which reveal how
  strange entropy counting was, imho.)

- Some tests aka code places directly reach into
  _gcry_rndlinux_gather_random() and thus only give errors in
  open_device() not the warning that initiated this ML thread.
  This i did not get at first, the tests suite passed nonetheless.

- P.S.: even if this patch is not used, i would suggest an audit
  of this file.

- RANDOM_CONF_ONLY_URANDOM lost its meaning in the past, and this
  patch does not reinstantiate that.  It cannot be done portably,
  except for OSs which provide getrandom(2).

- I shortly thought about using "extern", but i think doing so in
  an isolated fashion is surely wrong.

Ciao,

--steffen
|
|Der Kragenbaer,The moon bear,
|der holt sich munter   he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)
commit d37a0f8e (HEAD -> refs/heads/master)
Author: Steffen Nurpmeso 
AuthorDate: 2020-05-29 21:44:59 +0200
Commit: Steffen Nurpmeso 
CommitDate: 2020-05-29 22:03:43 +0200

random/rndlinux.c: avoid redundant actions on FDs if possible
---
 random/rand-internal.h |   5 +-
 random/random-csprng.c |   3 +-
 random/random-drbg.c   |   4 +-
 random/rndlinux.c  | 216 -
 4 files changed, 133 insertions(+), 95 deletions(-)

diff --git a/random/rand-internal.h b/random/rand-internal.h
index d99c6671..4e1298c1 100644
--- a/random/rand-internal.h
+++ b/random/rand-internal.h
@@ -90,10 +90,13 @@ void _gcry_rngsystem_randomize (void *buffer, size_t length,
 
 
 /*-- rndlinux.c --*/
+#if USE_RNDLINUX
+int _gcry_rndlinux_setup (void);
 int _gcry_rndlinux_gather_random (void (*add) (const void *, size_t,
enum random_origins),
-   enum random_origins origin,
+  enum random_origins origin,
   size_t length, int level);
+#endif
 
 /*-- rndunix.c --*/
 int _gcry_rndunix_gather_random (void (*add) (const void *, size_t,
diff --git a/random/random-csprng.c b/random/random-csprng.c
index b06810a0..7ae8 100644
--- a/random/random-csprng.c
+++ b/random/random-csprng.c
@@ -1120,8 +1120,7 @@ getfnc_gather_random (void))(void (*)(const void*, size_t,
  enum random_origins, size_t, int);
 
 #if USE_RNDLINUX
-  if ( !access (NAME_OF_DEV_RANDOM, R_OK)
-   && !access (NAME_OF_DEV_URANDOM, R_OK))
+  if (_gcry_rndlinux_setup () != -1)
 {
   fnc = _gcry_rndlinux_gather_random;
   return fnc;
diff --git a/random/random-drbg.c b/random/random-drbg.c
index 6124f5fb..7f63fade 100644
--- a/random/random-drbg.c
+++ b/random/random-drbg.c
@@ -1865,11 +1865,11 @@ _gcry_rngdrbg_reinit (const char *flagstr, gcry_buffer_t *pers, int npers)
 void
 _gcry_rngdrbg_close_fds (void)
 {
-#if USE_RNDLINUX
   drbg_lock ();
+#if USE_RNDLINUX
   _gcry_rndlinux_gather_random (NULL, 0, 0, 0);
-  drbg_unlock ();
 #endif
+  drbg_unlock ();
 }
 
 

Re: Certified OpenPGP-encryption after release of Thunderbird 78

[Stefan Claas]

karel-v_g--- via Gnupg-users wrote:

Hi,
 
> But it's a pity that
> Thunderbird developed its own solution because of licensing issues
> while we have a proven working solution with GnuPG...

We never know, maybe in the future someone writes again a fully working
solution for Thunderbird/GnuPG users.  

> But why should
> I take the discussion personal?? :-) Karel

Well, because sometimes people may not like what I write. :-)

Regards
Stefan

-- 
my 'hidden' service gopherhole:
gopher://iria2xobffovwr6h.onion

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Certified OpenPGP-encryption after release of Thunderbird 78

[karel-v_g--- via Gnupg-users]

Hello!
No, I don't work for an Aufsichtsbehörde and (fortunately) I don't have to deal 
with them directly most time. But the Aufsichtsbehörde defines how my work has 
to be done and they have the right to inspect it. And one of the things they 
require is use recommended (e.g. BSI) software for mailencryption. Of course 
there is no way knowing for them whether I comply or not without intercepting 
my mail or visiting my office.
But as always it might cause problems when not complying.
So I think I will continue use Thunderbird as MTA and use GPG4Win with copy and 
paste for the encryption part.
But it's a pity that Thunderbird developed its own solution because of 
licensing issues while we have a proven working solution with GnuPG...
But why should I take the discussion personal?? :-)
Karel


28. Mai 2020, 23:21 von s...@300baud.de:

> karel-v_g--- via Gnupg-users wrote:
>  
>
>> Hello!
>> The German translation should be "Aufsichtsbehörde" (or even better
>> "Rechtsfähige Anstalt des öffentlichen Rechts"). In fact I don't know
>> the exact translation and didn't find any appropriate in
>> Google-Translate or deepl. So "supervising authorities" was my best
>> guess without being a native speaker... Does this change the meaning
>> or anything else? Karel
>>
>
> Hi,
>
> while it is not my business, I do not understand why you have to take
> care about the Thunderbird issue, as a users and not the
> Aufsichtsbehörde ... If for example you have a job at the
> Aufsichtsbehörde then ok, like I said, I would contact gnupg.com and
> ask them if GnuPG Desktop (A Windows app) fits for your working
> environment and in case not what they would suggest, because the
> Aufsichtsbehörde should have IMHO funds to issue a professional
> licensed working solution for their employees.
>
> In case you only have to deal as a gpg4win user with the
> Aufsichtsbehörde via email, then I don't understand how would they
> detect if you would not comply by using later the new Thunderbird,
> without BSI approval.
>
> P.S. please don't take it personal!
>
> Regards
> Stefan
>


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: gpgAnon, draft 20150

[Stefan Claas]

LisToFacTor via Gnupg-users wrote:
 
> On 5/29/20 4:51 PM, Stefan Claas - s...@300baud.de wrote:
> > how does Alice protects her Live-CD and USB stick, when she leaves
> > home and Mallory gains access to them, so that for example the
> > Live-CD can be exchanged?
> Live-CD is a "public resource", available from multiple locations on
> the 'net and off, simply discarded when not practical to protect.
> Anybody can download, burn and give her a copy. On first use, checked
> with:
> 
> sudo cat /dev/cdrom | shasum -
> 
> While noting on the CD is a secret, it is quite unlikely an adversary
> can modify it without being detected.
> 
> > Does Alice use the USB-stick also with other mediums and if so how
> > does she detect bad USB? 
> USB hygiene is always a problem. Small devices and frequent hardware 
> cycling on the trusted device with two USB ports is helpful:
> dd if=/dev/sdb of=/dev/sdc bs=10M
> (with subsequent cat ... | shasum - thrown in for good measure)

Maybe you could add these two tips to the document, because Alice might
not know.

BTW. A while ago my Linux online Notebook was hacked and now I use
also a (Windows) offline Notebook for encryption and I have also
purchased a Kanguru Defender 3000 USB stick, wich allows to use
a virtual keyboard (under Windows) to type in the passphrase for
the encrypted USB stick and it has also a write-protect switch,
when using on an online computer. And it is bad USB safe.

Maybe interesting for someone?!




Regards
Stefan

-- 
my 'hidden' service gopherhole:
gopher://iria2xobffovwr6h.onion

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: gpgAnon, draft 20150

[LisToFacTor via Gnupg-users]

On 5/29/20 4:51 PM, Stefan Claas - s...@300baud.de wrote:

how does Alice protects her Live-CD and USB stick, when she leaves home
and Mallory gains access to them, so that for example the Live-CD can
be exchanged?

Live-CD is a "public resource", available from multiple locations on
the 'net and off, simply discarded when not practical to protect.
Anybody can download, burn and give her a copy. On first use, checked
with:

sudo cat /dev/cdrom | shasum -

While noting on the CD is a secret, it is quite unlikely an adversary
can modify it without being detected.


Does Alice use the USB-stick also with other mediums and if so how does
she detect bad USB? 
USB hygiene is always a problem. Small devices and frequent hardware 
cycling on the trusted device with two USB ports is helpful:

dd if=/dev/sdb of=/dev/sdc bs=10M
(with subsequent cat ... | shasum - thrown in for good measure)

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: gpgAnon, draft 20150

[Stefan Claas]

LisToFacTor via Gnupg-users wrote:
 
> The setup described in this "how-to" was originally put together
> and used (and possibly still is) quite a while ago, using
> Disastry's  PGP 2.6.3ia-multi06 as the crypto back end.
> 
> This guide has been composed from bits and pieces of the original
> user documentation, scissoring out the content that it refers to
> vaguely as "group policies". Other than that, the only substantial
> change is the replacement of pgp 2.6.3ia-multi06 with gpg 1.4.10
> (or later).
> 
> Technical testing of the described setup with the new crypto back
> end is underway.
> 
> Any comments and criticism, of whatever kind, is welcome, if it
> implies the permission to incorporate it into the final version
> of the document.
> 
> Available to first one hundred downloads at:
> https://send.firefox.com/download/d49d3f511202f943/#ITQHMkZexDePZ1JMwziuqg

Hi,

how does Alice protects her Live-CD and USB stick, when she leaves home
and Mallory gains access to them, so that for example the Live-CD can
be exchanged?

Does Alice use the USB-stick also with other mediums and if so how does
she detect bad USB?



Regards
Stefan

-- 
my 'hidden' service gopherhole:
gopher://iria2xobffovwr6h.onion

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: libgcrypt: random source via library on Linux?

[Steffen Nurpmeso]

Hello.

Werner Koch wrote in
<87sgfjrqf1@wheatstone.g10code.de>:
 |On Thu, 28 May 2020 14:43, Steffen Nurpmeso said:
 |> ./configure \
 |> --prefix=/usr \
 |> --disable-padlock-support \
 |> --enable-static=yes
 |> make
 |> make DESTDIR=$PKG install
 |
 |That is pretty standard except for the --disable-padlock-support - why
 |do you use this?  Padlock is only used on VIA CPUs and has an auditable
 |design in contrast to RDRAND (which is used by Libgcrypt be default).

I am overasked why this is done.  I have not looked for how RDRAND
bugs are handled by libgcrypt either, Werner.  Wait.  Sigh.

Looking at the source it seems libgcrypt knows about the Linux
getrandom systemcall.  Yet it does not seem to know about glibc's
getrandom library function.

Hm, so why does random/random-csprng.c:getfnc_gather_random() look
out for NAME_OF_DEV_*RANDOM at all .. hmm .. i must admit
random/rndlinux.c:_gcry_rndlinux_gather_random() seems strange to
me.  :)  Two possible calls to getpid, could be "((apid = XPID) !=
my_pid || !add)"; ah i see the FDs could become cached (until
fork), .. and then the getrandom syscall is tried even though FDs
have been opened despite its presence.  This, excuse me ;),
i would change quite a bit.  I would not do any FD related thing
at all if getrandom is available, and i, for the MUA i maintain,
simply look for getrandom, library or syscall (the latter came
first; users can explicitly specify via VAL_RANDOM what they want,
though).

Looking at the development version now it finally seems to me that
the library call is supported.

I still would not do it like that, because if software cannot rely
on what has been detected at configuration time all bets are off.
I must admit i do the NOSYS check myself for this thing, but only
for it, not for anything else.  Also not for "system calls" which
change behaviour dependent on library symbol version
(realpath(2/3) comes to mind, exclusively).

Anyhow, unless i am mistaken from this five minute looking, that
random/random-csprng.c:getfnc_gather_random()

  #if USE_RNDLINUX
if ( !access (NAME_OF_DEV_RANDOM, R_OK)
 && !access (NAME_OF_DEV_URANDOM, R_OK))
  {
fnc = _gcry_rndlinux_gather_random;
return fnc;
  }
  #endif

i would change, maybe with a new call-in to rndlinux.c which
should be made responsible for Linux-only environmental detections
imho.  Like that it could solely depend on getrandom, and make all
the FDs optional, maybe by testing for NOSYS with a one byte read
or what at first, or by later aborting if collecting random fails
if that is possible.  (For my MUA i use this for seeding only
anyhow.)

 |Are you running in FIPS mode?
 |
 |Can you run the Libgcrypt test suite?  In particular
 |
 |$ libgcrypt/tests/version
 |$ libgcrypt/tests/random --verbose --debug

Well i could.  Is this still of interest?

Ciao,

--steffen
|
|Der Kragenbaer,The moon bear,
|der holt sich munter   he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

gpgAnon, draft 20150

[LisToFacTor via Gnupg-users]

The setup described in this "how-to" was originally put together
and used (and possibly still is) quite a while ago, using
Disastry's  PGP 2.6.3ia-multi06 as the crypto back end.

This guide has been composed from bits and pieces of the original
user documentation, scissoring out the content that it refers to
vaguely as "group policies". Other than that, the only substantial
change is the replacement of pgp 2.6.3ia-multi06 with gpg 1.4.10
(or later).

Technical testing of the described setup with the new crypto back
end is underway.

Any comments and criticism, of whatever kind, is welcome, if it
implies the permission to incorporate it into the final version
of the document.

Available to first one hundred downloads at:
https://send.firefox.com/download/d49d3f511202f943/#ITQHMkZexDePZ1JMwziuqg



___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Signature mismatch for secp256k1

[Louis Holbrook]

I'm trying to use gpg-agent to sign for cryptocurrency purposes, using
the secp256k1 curve. I've tried a few hashes, but one of them gets a
different resulting signature than other implementations. I've compared
against libsecp256k1 and nodejs elliptic library.

I won't post the code here, but I also put up a question o stackexchange
on the same topic which lists my attempt:

https://unix.stackexchange.com/questions/589730/gnupg-secp256k1-signature-does-not-match-other-implementations

Any pointers would be appreciated. I'm guessing it's some silly
oversight of mine, but I can't spot it.

Thanks.

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Certified OpenPGP-encryption after release of Thunderbird 78

[Alessandro Vesely via Gnupg-users]

On Fri 29/May/2020 12:29:48 +0200 Stefan Claas wrote:
> Binarus wrote:
>> On 28.05.2020 23:21, Stefan Claas wrote:
>>> 
>>> while it is not my business, I do not understand why you have to
>>> take care about the Thunderbird issue, as a users and not the
>>> Aufsichtsbehörde ... If for example you have a job at the
>>> Aufsichtsbehörde then ok, like I said, I would contact gnupg.com and
>>> ask them if GnuPG Desktop (A Windows app) fits for your working
>>> environment and in case not what they would suggest, because the
>>> Aufsichtsbehörde should have IMHO funds to issue a professional
>>> licensed working solution for their employees.
>>> 
>>> In case you only have to deal as a gpg4win user with the
>>> Aufsichtsbehörde via email, then I don't understand how would they
>>> detect if you would not comply by using later the new Thunderbird,
>>> without BSI approval.
>> 
>> This is not my field, but I believe that (besides authorities) there
>> are companies or other institutions which *must* use certified
>> encryption solutions. Some ideas:
> 
> [...]
> 
> Yes, understand. But then if those institutions have no funds or
> are not willing to invested in their IT security infrastructure
> then they may ask the BSI how to proceed. Maybe the BSI has funds
> to let gnupg.com develope a custom Windows solution for them.
> 
> The other option would be that the OP and others continue using
> their current Thunderbird/Enigmail/gpg4win setup.


Any chance that the BSI will approve the RNP library that Thunderbird is going
to use?


Best
Ale
-- 
























___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Certified OpenPGP-encryption after release of Thunderbird 78

[Werner Koch via Gnupg-users]

On Tue, 26 May 2020 12:27, karel-v_g--- said:

> Because of this I have been using a combination of Thunderbird,
> Enigmail and Gpg4Win, as the latter one is certified by German BSI.

Well, it is not certified but approved to handle data at the EU
RESTRICTED level (BSI-VSA-10400 and 10412).  There a lot of side
condition you have to meet to use that which are detailed in the SecOPs.

TB has not been approved to handle restricted data because it does not
clearly show whether important conditions are met.  GpgOL and KMail are
able to meet these requirements for email; Kleopatra for file
encryption.



Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


signature.asc
Description: PGP signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Certified OpenPGP-encryption after release of Thunderbird 78

[Stefan Claas]

Binarus wrote:
 
> 
> 
> On 28.05.2020 23:21, Stefan Claas wrote:
> > 
> > while it is not my business, I do not understand why you have to
> > take care about the Thunderbird issue, as a users and not the
> > Aufsichtsbehörde ... If for example you have a job at the
> > Aufsichtsbehörde then ok, like I said, I would contact gnupg.com and
> > ask them if GnuPG Desktop (A Windows app) fits for your working
> > environment and in case not what they would suggest, because the
> > Aufsichtsbehörde should have IMHO funds to issue a professional
> > licensed working solution for their employees.
> > 
> > In case you only have to deal as a gpg4win user with the
> > Aufsichtsbehörde via email, then I don't understand how would they
> > detect if you would not comply by using later the new Thunderbird,
> > without BSI approval.
> 
> This is not my field, but I believe that (besides authorities) there
> are companies or other institutions which *must* use certified
> encryption solutions. Some ideas:

[...]

Yes, understand. But then if those institutions have no funds or
are not willing to invested in their IT security infrastructure
then they may ask the BSI how to proceed. Maybe the BSI has funds
to let gnupg.com develope a custom Windows solution for them.

The other option would be that the OP and others continue using
their current Thunderbird/Enigmail/gpg4win setup.

Regards
Stefan

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: libgcrypt: random source via library on Linux?

[Werner Koch via Gnupg-users]

On Thu, 28 May 2020 14:43, Steffen Nurpmeso said:

> ./configure \
> --prefix=/usr \
> --disable-padlock-support \
> --enable-static=yes
> make
> make DESTDIR=$PKG install

That is pretty standard except for the --disable-padlock-support - why
do you use this?  Padlock is only used on VIA CPUs and has an auditable
design in contrast to RDRAND (which is used by Libgcrypt be default).

Are you running in FIPS mode?

Can you run the Libgcrypt test suite?  In particular

$ libgcrypt/tests/version
$ libgcrypt/tests/random --verbose --debug


Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


signature.asc
Description: PGP signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Certified OpenPGP-encryption after release of Thunderbird 78

[Binarus]

On 28.05.2020 23:21, Stefan Claas wrote:
> 
> while it is not my business, I do not understand why you have to take
> care about the Thunderbird issue, as a users and not the
> Aufsichtsbehörde ... If for example you have a job at the
> Aufsichtsbehörde then ok, like I said, I would contact gnupg.com and
> ask them if GnuPG Desktop (A Windows app) fits for your working
> environment and in case not what they would suggest, because the
> Aufsichtsbehörde should have IMHO funds to issue a professional
> licensed working solution for their employees.
> 
> In case you only have to deal as a gpg4win user with the
> Aufsichtsbehörde via email, then I don't understand how would they
> detect if you would not comply by using later the new Thunderbird,
> without BSI approval.

This is not my field, but I believe that (besides authorities) there are
companies or other institutions which *must* use certified encryption
solutions. Some ideas:

- The OP might be employed at a city administration of a small village
where the full set of regulations is relevant, but where there is no
money (as in many small villages) to buy support.

- The OP might be employed at a company like a hospital, a nuclear
plant, a company which develops or sells military goods, a law office, a
tax office, a (medical) insurance, a bank, and so on - you get the idea :-)

While I actually don't know in detail which sort of company is bound by
which regulation, I am sure that there are dozens of company types and
hundreds, if not thousands of companies which are legally restricted to
use only BSI-certified encryption software, especially companies which
handle sensitive personal data or which compromise public safety if they
let leak data.

Even more, since the arrival of the GPDR, each company -even the
smallest one- has to put significant effort into protecting personal
data, and has to document in detail their respective policies and
methods. When implementing the respective concepts and explaining /
documenting why they are safe and how they protect personal data, it is
of great help when the BSI has certified as many parts of the software
as possible.

Furthermore, to me, the OP sounds if he is not only employed at a
company as a normal user, but as a part-time admin who has been asked to
implement the email infrastructure for his colleagues besides his normal
work (because the management as usual does not understand the importance
and value of such work and the expertise and time which is needed).

Regards,

Binarus

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users