Re: [fa...@ariis.it: Re: How to verify a signed mail (silly question maybe, sorry ; )]

2014-07-03 Thread Linux DEBIAN
Hello, thanks for your reply. Maybe I do soemthing wrong and following the instructions, still receiving 'bad signature'. It's my mail and my signature (for testing purposes) so I'm sure signature is ok, btw. Does it matter if in the beginning of the part is: Content-Type: Text/Plain;

Re: GnuPG 2.1.0-beta442: t-timestuff.c:118: test 17 failed

2014-07-03 Thread Werner Koch
On Tue, 24 Jun 2014 04:38, ca+gn...@esmtp.org said: This patch (hack?) fixes it for me (local timezone is PDT). I changed the test to use timegm and only if that is missing I use this patch. Thanks, Werner -- Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.

[Announce] The fifth Beta for GnuPG 2.1 is now available for testing

2014-07-03 Thread Werner Koch
Hello! I just released the fifth *beta version* of GnuPG 2.1. It has been released to give you the opportunity to check out new features and to fix the bugs in the last beta. If you need a stable and fully maintained version of GnuPG, you should use version 2.0.25 or 1.4.18. This

Analogien um das Prinzip von PGP zu erklären

2014-07-03 Thread Daniel Krebs
Hallo, da ich das gerade mit Matthias von der FSFE im Rahmen von #EmailSelfDefense diskutiere, mal eine Frage: Welche Analogien benutzt ihr, wenn ihr Menschen das Prinzip von PGP/GPG erklärt? Ich verwende ich meistens folgende Version: Es gibt ein Schloss mit zwei Schlüssellöchern. Jeder

Re: Analogien um das Prinzip von PGP zu erklären

2014-07-03 Thread Neal H. Walfield
At Thu, 03 Jul 2014 12:50:50 +0200, Daniel Krebs wrote: da ich das gerade mit Matthias von der FSFE im Rahmen von #EmailSelfDefense diskutiere, mal eine Frage: Welche Analogien benutzt ihr, wenn ihr Menschen das Prinzip von PGP/GPG erklärt? Ich verwende ich meistens folgende Version: Es

Re: Analogien um das Prinzip von PGP zu erklären

2014-07-03 Thread Werner Koch
On Thu, 3 Jul 2014 12:50, mailingl...@krebs.uno said: Anregungen, Meinungen? You should translate your question to English or send it to gnupg...@gnupg.org. Salam-Shalom, Werner -- Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.

This time in English: How to explain the principles of PGP, looking for metaphors

2014-07-03 Thread Daniel Krebs
Sorry! I picked the wrong language / list last time... So in English: What metaphors do you use when explaining people PGP? Two examples: 1. A lock with two keys? 2. A lock (public) and a key (private) Something completely different? Problems with both: 1. Seems to be kind of hard to understand

Re: Analogien um das Prinzip von PGP zu erklären

2014-07-03 Thread Pete Stephenson
I seem to recall someone on this list using a mailbox like the one at [1] as an analogy for public-key encryption: anyone can walk up to the mailbox and place a letter in the slot (encrypting a message to the recipient's public key), but they cannot retrieve any other letters in the box [2]. That

Re: Analogien um das Prinzip von PGP zu erklären

2014-07-03 Thread Fraser Tweedale
On Thu, Jul 03, 2014 at 01:46:33PM +0200, Neal H. Walfield wrote: At Thu, 03 Jul 2014 12:50:50 +0200, Daniel Krebs wrote: da ich das gerade mit Matthias von der FSFE im Rahmen von #EmailSelfDefense diskutiere, mal eine Frage: Welche Analogien benutzt ihr, wenn ihr Menschen das Prinzip

Re: This time in English: How to explain the principles of PGP, looking for metaphors

2014-07-03 Thread Fraser Tweedale
On Thu, Jul 03, 2014 at 02:06:04PM +0200, Daniel Krebs wrote: Sorry! I picked the wrong language / list last time... So in English: What metaphors do you use when explaining people PGP? Two examples: 1. A lock with two keys? 2. A lock (public) and a key (private) Something completely

Re: Analogien um das Prinzip von PGP zu erklären

2014-07-03 Thread Fraser Tweedale
On Thu, Jul 03, 2014 at 10:56:30PM +1000, Fraser Tweedale wrote: On Thu, Jul 03, 2014 at 01:46:33PM +0200, Neal H. Walfield wrote: At Thu, 03 Jul 2014 12:50:50 +0200, Daniel Krebs wrote: da ich das gerade mit Matthias von der FSFE im Rahmen von #EmailSelfDefense diskutiere, mal eine

Analogies to explain the basic principles of encryption as used by OpenPGP (was: Re: Analogien um das Prinzip von PGP zu erklären)

2014-07-03 Thread Olav Seyfarth
-BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 Hi Daniel, I'd also rather use the analogy of a padlock without key to be distributed by the receipient of a message. That way you're able to explain the prerequisite for asymmetric crypto as we use it in OpenPGP: the receipent must do something

Re: Analogien um das Prinzip von PGP zu erklären

2014-07-03 Thread Robert J. Hansen
I seem to recall someone on this list using a mailbox like the one at [1] as an analogy for public-key encryption: anyone can walk up to the mailbox and place a letter in the slot (encrypting a message to the recipient's public key), but they cannot retrieve any other letters in the box [2].

Re: Analogies to explain the basic principles of encryption as used by OpenPGP

2014-07-03 Thread Daniel Krebs
Hi Olav, Am 03.07.2014 14:00, schrieb Olav Seyfarth: I'd also rather use the analogy of a padlock without key to be distributed by the receipient of a message. That way you're able to explain the prerequisite for asymmetric crypto as we use it in OpenPGP: the receipent must do something BEFORE

Re: [Announce] The fifth Beta for GnuPG 2.1 is now available for testing

2014-07-03 Thread Werner Koch
On Thu, 3 Jul 2014 13:27, kristian.fiskerstr...@sumptuouscapital.com said: Functionally things are working nicely for me using git master. A feature request might be to make the number of objects for a keyserver refresh customizable as I can't refresh my keyring using 2.1 (but can using

Re: Analogien um das Prinzip von PGP zu erklären

2014-07-03 Thread Werner Koch
On Thu, 3 Jul 2014 14:56, fr...@frase.id.au said: encryption, but will lead to more confusion when attempting to understand/explain signing - where indeed the public key is used to decrypt a digest encrypted by a public key. Signing is a very different thing than encryption. It has nothing

Re: How to verify a signed mail (silly question maybe, sorry ;)

2014-07-03 Thread Ingo Klöcker
On Wednesday 02 July 2014 19:38:41 Linux DEBIAN wrote: Hello all, now I use KMail post client where it's alla automatically checked but when I am on the webmail where the signing and verifying is not built-in supported and when I receive an e-mail with an attchement signature.asc, how

Re: [fa...@ariis.it: Re: How to verify a signed mail (silly question maybe, sorry ; )]

2014-07-03 Thread Ingo Klöcker
On Thursday 03 July 2014 08:49:12 Linux DEBIAN wrote: Hello, thanks for your reply. Maybe I do soemthing wrong and following the instructions, still receiving 'bad signature'. I'm not surprised. It seems that Francesco Ariis has left out a crucial step (or you have removed it when you

Re: riseup.net OpenPGP Best Practices article

2014-07-03 Thread Daniel Kahn Gillmor
On 06/28/2014 12:09 AM, Robert J. Hansen wrote: When faced with that, it's only a matter of time until Alice decides to put 3DES first in her own preference list. And then all her communications to Bob have 112 bits of keyspace, not the 256 Bob demands. I think you're talking about

Key distribution via NFC

2014-07-03 Thread Robert J. Hansen
A good friend just gave me a handful of NFC tags that are capable of storing about 400 bytes. It's a convenient form factor: a cardboard disk with an adherent backing, perhaps 2.5cm across. Bring it close to a mobile phone and presto, bang, it can access the 400 bytes. This is too large to

Re: Key distribution via NFC

2014-07-03 Thread Hauke Laging
Am Do 03.07.2014, 23:54:39 schrieb Robert J. Hansen: Bring it close to a mobile phone and presto, bang, it can access the 400 bytes. This is too large to store an RSA or DSA2 certificate, unfortunately. I don't even have a smartphone... but 1) might it be possible to combine several of

Re: riseup.net OpenPGP Best Practices article

2014-07-03 Thread Robert J. Hansen
I think you're talking about personal-cipher-preferences here, which Alice uses to govern the cipher she uses. Correct. Note that she could even put IDEA first here. Sure, but it wouldn't take unless Bob had IDEA in his preference list. If Bob's preference list is AES256 CAMELLIA256 3DES,

Re: Key distribution via NFC

2014-07-03 Thread Robert J. Hansen
This is too large to store an RSA or DSA2 certificate, unfortunately. Too *small*. Sorry. Time for me to go drink coffee straight from the pot. Also, for Americans, happy Fourth of July. :) ___ Gnupg-users mailing list Gnupg-users@gnupg.org

Re: Key distribution via NFC

2014-07-03 Thread Robert J. Hansen
1) might it be possible to combine several of these storage devices (reading them one after the other) to add up their capacity? Probably, but once you've got a dozen of these things they sort of stop being a convenient form factor. :) 2) wouldn't it be enough to transfer the mainkey? Or

Re: riseup.net OpenPGP Best Practices article

2014-07-03 Thread Daniel Kahn Gillmor
On 07/04/2014 12:08 AM, Robert J. Hansen wrote: Bob is all about I must have at least 256 bits of keyspace in all my email! But Bob can't do that, because Alice can *always* degrade him to 112 bits by choosing 3DES. Of course. And Alice can always send Bob cleartext too. does that mean that

Re: riseup.net OpenPGP Best Practices article

2014-07-03 Thread Robert J. Hansen
Of course. And Alice can always send Bob cleartext too. does that mean that Bob shouldn't offer any encryption key at all because there's no guarantee that it will be used? It means Bob should have a line item for that in his security model. Alice may send me cleartext. It also means Bob

Re: Key distribution via NFC

2014-07-03 Thread Robert J. Hansen
You can also get all of the above properties... *Almost*. NFC is significantly more convenient than fumbling with your phone's camera app, taking a snapshot, etc. Wave it and it's done. NFC has some interesting human interface engineering behind it. signature.asc Description: OpenPGP

Re: Key distribution via NFC

2014-07-03 Thread Daniel Kahn Gillmor
On 07/03/2014 11:54 PM, Robert J. Hansen wrote: the ability to store 400 bytes, to access it quickly and easily, and all in a tag that costs less than a dollar and can be read with almost any modern smartphone, is kind of cool. it is cool indeed. You can also get all of the above properties,