Re: Best practices for obtaining a new GPG certificate

2021-03-19 Thread Mark via Gnupg-users
It also has issues with signed messages and lists. For example you signed this message but it says "uncertain digital signature".  I don't remember this being an issue in the older TB/Enigmail. On 3/19/2021 10:42 AM, Werner Koch via Gnupg-users wrote: On Fri, 19 Mar 2021 03:33, Robert J. Hansen

Re: Best practices for obtaining a new GPG certificate

2021-03-19 Thread Mark via Gnupg-users
It "does and it doesn't" I have some that were created in Kleopatra and then imported into Thunderbird 78. As for creating them, no You don't get to choose any options when generating ECC keys. On 3/19/2021 12:33 AM, Robert J. Hansen via Gnupg-users wrote: The next default is ECC

Re: Best practices for obtaining a new GPG certificate

2021-03-19 Thread Werner Koch via Gnupg-users
On Fri, 19 Mar 2021 03:33, Robert J. Hansen said: > Last I checked, Thunderbird 78 did not support ed25519+cv25519 > keys. That's not a niche implementation. I did extensive test with Ribose to make sure that RNP (the crypto engine now used by TB) is compatible with GnuPG. Thus I wonder why TB

Re: Prompting on concurrent invocations of gpg

2021-03-19 Thread John Lane
On 16/03/2021 11:19, John Lane wrote: > Hello, I have a scenario where gpg is prompting for a passphrase when I > don't think it should because it is cached in the agent. It seems to be > triggered by concurrent use. Here is an example. > I've asked someone else to try this and they are seeing

Re: header protection drafts too early to implement (Re: Protect email experience not Subject:s (hypothesis, draft))

2021-03-19 Thread Bernhard Reiter
Am Freitag 12 März 2021 18:02:41 schrieb Bernhard Reiter: > To keep you in the loop, my main take-away so far: > It is not ready to be implemented yet, because If it is implemented, to me it makes sense to a) only implement one method, and this seems to be to wrap one full message in MIME,

Re: Best practices for obtaining a new GPG certificate

2021-03-19 Thread Neal H. Walfield
On Fri, 19 Mar 2021 08:33:17 +0100, Robert J. Hansen via Gnupg-users wrote: > > > The next default is ECC (ed25519+cv25519) which is supported by most > > OpenPGP implementations. Only if you have a need to communicate with > > some niche implementaions you need to use rsa3072. > > Last I

Re: Best practices for obtaining a new GPG certificate

2021-03-19 Thread Robert J. Hansen via Gnupg-users
The next default is ECC (ed25519+cv25519) which is supported by most OpenPGP implementations. Only if you have a need to communicate with some niche implementaions you need to use rsa3072. Last I checked, Thunderbird 78 did not support ed25519+cv25519 keys. That's not a niche implementation.

Re: Best practices for obtaining a new GPG certificate

2021-03-19 Thread Werner Koch via Gnupg-users
On Thu, 18 Mar 2021 19:34, David Mehler said: > in the output there's ECC output should I go with an ECC-style key or > RSA? As regards RSA keysize I typically use 4096. The next default is ECC (ed25519+cv25519) which is supported by most OpenPGP implementations. Only if you have a need to

Re: Timeout when signing

2021-03-19 Thread Werner Koch via Gnupg-users
On Thu, 18 Mar 2021 13:57, Nick Cripps said: > I'm trying to encrypt and sign a large file. It takes a while to do this, > and I then do other things while this is happening. It then completes and > presumably asks me for my key passphrase, but I miss this and it times out, I know this problem

Re: [EXT] Best practices for obtaining a new GPG certificate

2021-03-19 Thread Werner Koch via Gnupg-users
On Fri, 19 Mar 2021 01:50, Ángel said: > The FAQis outdated. GnuPG was indeed updated some years ago to use 3072 > as the default size for rsa Actually 7 months: Noteworthy changes in version 2.2.22 (2020-08-27) - * gpg: Change the default key

Re: Best practices for obtaining a new GPG certificate

2021-03-19 Thread Robert J. Hansen via Gnupg-users
I'd like to know current best practices for obtaining a new one? This question gets asked so often that it has its own FAQ entry. Yes, parts of the FAQ are outdated, but this particular one is very current. https://www.gnupg.org/faq/gnupg-faq.html#tuning * You don't need to "tune" GnuPG

Re: [EXT] Best practices for obtaining a new GPG certificate

2021-03-19 Thread Robert J. Hansen via Gnupg-users
Reading the URLs given by the OP, I see that the GPG FAQ (1) talks about a default of '2048' but in the latest (2.2.17) release of GPG it looks like the default is now '3072': Yep. [puts on maintainer hat] The last time I suggested revisions to that text there was no community consensus on