Re: GPG's vulnerability to brute force [WAS: Re: GPG's vulnerability to quantum cryptography]

2014-05-14 Thread Robert J. Hansen
On 5/14/2014 6:11 PM, Leo Gaspard wrote: > Well... Apart from the assumption I stated just below (ie. single > bit flip for AES), I cannot begin to think about an error I might > have done with this one, apart from misunderstanding Wikipedia's > statement that "The processing rate cannot be higher

Re: GPG's vulnerability to brute force [WAS: Re: GPG's vulnerability to quantum cryptography]

2014-05-14 Thread Leo Gaspard
On Wed, May 14, 2014 at 01:15:40PM -0700, Robert J. Hansen wrote: > >First, the Margolus-Levitin limit: "6.10^33 ops.J^{-1}.s^{-1} maximum" > >So, dividing the 2^128 by 6.10^33 gives me a bit less than 57000 J.s > >(assuming testing an AES key is a single operation). So, that's less than > >1min fo

Re: GPG's vulnerability to brute force [WAS: Re: GPG's vulnerability to quantum cryptography]

2014-05-14 Thread Robert J. Hansen
10^10 * 10^6 = 10^16. So far your estimate is off by a factor of a thousand trillion. *Ten* thousand trillion. Sorry, that one's entirely my error. ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-us

Re: GPG's vulnerability to brute force [WAS: Re: GPG's vulnerability to quantum cryptography]

2014-05-14 Thread Robert J. Hansen
First, the Margolus-Levitin limit: "6.10^33 ops.J^{-1}.s^{-1} maximum" So, dividing the 2^128 by 6.10^33 gives me a bit less than 57000 J.s (assuming testing an AES key is a single operation). So, that's less than 1min for 1kJ. Pretty affordable, I believe. No. But since I'm going to be giv

Re: Result of the crowdfounding

2014-05-14 Thread Fizzlifax
Hi Werner, thanks a lot for Your freely explications! - This was really interesting for me... another question ist the VAT for about 5212,-- € > The legal entity behind GnuPG is my company g10 code. This is a > commercial entity and we have to pay VAT on all donations (19% from the > amount we

Re: Future inclusion of Threefish in Gnupg?

2014-05-14 Thread David Shaw
On May 14, 2014, at 9:35 AM, Sin Trenton wrote: > Hello everyone, > > Just out of curiousity, are there any plans for including Threefish into > GnuPG? > Or does it have to be incorprorated into the OpenPGP standard first and > *then* perhaps baked into GnuPG? Yes. GnuPG follows the OpenPGP

GPG's vulnerability to brute force [WAS: Re: GPG's vulnerability to quantum cryptography]

2014-05-14 Thread Leo Gaspard
On Wed, May 14, 2014 at 12:21:36PM -0400, Robert J. Hansen wrote: > > Since the well known agency from Baltimore uses its influence to have > > crypto standards coast close to the limit of the brute-forceable, 128 > > bit AES will be insecure not too far in the future. > > No. > > https://www.gnu

Future inclusion of Threefish in Gnupg?

2014-05-14 Thread Sin Trenton
Hello everyone, Just out of curiousity, are there any plans for including Threefish into GnuPG? Or does it have to be incorprorated into the OpenPGP standard first and *then* perhaps baked into GnuPG? In simple curiousity and because I have a soft spot for Twofish[1] Sin Trenton [1] Soft sp

Re: GPG's vulnerability to quantum cryptography

2014-05-14 Thread Robert J. Hansen
I might have to ask Robert how comfortable his new asbestos longjohns are. Rather, as evidenced by my willingness to try and tackle this one. To a first approximation, trust is confidence in the future's predictability. My friends who grew up in dictatorships tell me the uncertainty was fa

Re: "gpg --with-fingerprint $FILE" is not listing the keyfingerprint in some cases

2014-05-14 Thread Aaron Toponce
On Wed, May 14, 2014 at 06:26:31PM +0200, Werner Koch wrote: > > Ah. Interesting. Should I file a proper bug against GnuPG then? > > Please do that. Done. https://bugs.g10code.com/gnupg/issue1640 Thanks, -- . o . o . o . . o o . . . o . . . o . o o o . o . o o . . o o o o . o

Re: "gpg --with-fingerprint $FILE" is not listing the keyfingerprint in some cases

2014-05-14 Thread Werner Koch
On Wed, 14 May 2014 14:51, aaron.topo...@gmail.com said: > Ah. Interesting. Should I file a proper bug against GnuPG then? Please do that. Shalom-Salam, Werner -- Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz. ___ Gnupg-users mail

Re: GPG's vulnerability to quantum cryptography

2014-05-14 Thread Robert J. Hansen
> Since the well known agency from Baltimore uses its influence to have > crypto standards coast close to the limit of the brute-forceable, 128 > bit AES will be insecure not too far in the future. No. https://www.gnupg.org/faq/gnupg-faq.html#brute_force

Re: "gpg --with-fingerprint $FILE" is not listing the keyfingerprint in some cases

2014-05-14 Thread Aaron Toponce
On Tue, May 13, 2014 at 11:30:21PM -0400, David Shaw wrote: > Looks like a bug. Note that on each of the keys that didn't work there is a > direct signature on the key. This is not very common, and is usually used > for a designated revoker (i.e. "I permit so-and-so to revoke my key for me"). > I

Re: "gpg --with-fingerprint $FILE" is not listing the keyfingerprint in some cases

2014-05-14 Thread Aaron Toponce
On Wed, May 14, 2014 at 11:32:07AM +1000, Fraser Tweedale wrote: > This behaviour also occurs for me in 2.0.22. Instead of exporting > the key, you could use --list-keys, which works for me: Yeah, I'm not interesting in running it from the keyring, as I am assuming that the key is not imported, b

Re: Result of the crowdfounding

2014-05-14 Thread Werner Koch
On Tue, 13 May 2014 18:58, fizzli...@posteo.net said: > What for is this campaign manager? - Is this a part of goteo or of > gnupg or somebody else? This is what I had to pay to Sam for his work on the campaign. My friends at the FSFE suggested that I should run a campaign as soon as possible an

Re: GPG's vulnerability to quantum cryptography

2014-05-14 Thread Peter Lebbing
On 14/05/14 09:47, Michael Anders wrote: > Since the well known agency from Baltimore uses its influence to have > crypto standards coast close to the limit of the brute-forceable, 128 > bit AES will be insecure not too far in the future. Brute-forcing a 128 bits key is, as far as we know, impossi

encryption information in a signature

2014-05-14 Thread Hauke Laging
Hello, I would like to suggest a probably easier alternative to my proposal "sign encrypted emails": http://lists.gnupg.org/pipermail/gnupg-users/2014-January/048681.html The purpose is that the recipient can be sure that the message has left the sending system encrypted (and: encrypted for a

GPG's vulnerability to quantum cryptography

2014-05-14 Thread Michael Anders
> > GPG encrypted data (using RSA) can be collected today and easily decrypted > after 50-100 years using a quantum computer. See: > https://en.wikipedia.org/wiki/Shor%27s_algorithm Well let's see. Usually in a new technology, once you are really going to apply it in the real world, new problems