Comment by tptacek
4 days ago
There's a good idea in PGP, and a very bad one. The good idea --- and PGP genuinely deserves credit here --- is end-user, consumer-facing strong cryptography tools. That's now universally accepted and has been for decades. The bad idea is a tool with PGP's design, of "cryptographic jack-of-all-trades". PGP's design has aged like milk, and PGP itself is a security liability in almost every system that hosts it.
PGP is special to me, I was a beta user when Phil uploaded it to some Colorado BBSes, way back when. He even made time to talk to teenage me about it on the phone.
What's crazy is when it was concieved, we didn't have trusted strong cryptographic primitives. We did have DES but it wasn't trusted. We did have some of these crazy ideas that we all would have "secrets" and you might put those secrets encrypted on a disk in a vault and you'd not even want the feds to get them. Now we have all sorts of much more vetted crypto primitives, but the idea of actual secrets you'd keep in cold storage is largely dead. You're spot on that modern use cases need different APIs and tools and specialized solutions.
Nice username.
https://hackyourmom.com/en/osvita/u-pamyat-pro-kevina-mitnik...
PGP the packet formats, PGP the tool(s), OpenPGP the specs, GnuPG the tool, GnuPG the library; or any of the other libraries? Web of Trust? All of it? None of the above?
Any time this topic comes up, here and elsewhere, I find that most discussions revolve around different understandings and misunderstandings what people mean when they say “PGP”, and rarely lead to anything beyond that. - no this is PGP no you’re wrong that is PGP and so on and on…
Almost all of it, yes.
The packet format is awful, full of complexity, backwards compatibility mess, and serious security problems.
The spec is pretty awful in that a lot of the complexity is due to keeping compatibility with things that are a terrible idea. And also in that the general concept of a long lived key turned out to be a bad one.
The library or lack thereof IMO cripped PGP/GPG back when it was relevant. It's nigh impossible to make tooling for it, or it was until Sequoia showed up, which was extremely late. Things like doing stats on keys, or doing anything but what the binary wants to do were terribly painful until Sequoia.
The Web of Trust was an interesting idea for a while, but failed to transition to the modern internet.
By the time you fix all the things what remains looks nothing like PGP, so it amounts to "all of it is bad".
All of those things are liabilities (I read them carefully and mentally checked them off one by one; I'm not just being rhetorical). I wrote a sibling comment going into more detail, but happy to answer questions.
Well, gpg2 is an implementation of openpgp and is GnuPG the tool correct? So are you saying that when I `gpg2 --symmetric myfile` I'm doing something harmful rather than useful?
The expectation is that anybody who ends up with the encrypted copy would have an impossible time trying to decrypt it without, I don't know, millions of dollars worth of compute per year for decades to throw at it or something like that.
1 reply →
PGP: The flamethrower (kids love this one)
Each of these bad in a different and exciting way, if your idea of exciting is reading mailing list threads.
(The idea of trust networks is not bad. But PGP’s implementation of them is bad.)
What’s a better one? Are you thinking of something like Keybase?
Another thing is also that email itself was not designed with encryption in mind and because it is decentralized and backwards-compatible it is hard to enforce new rules (everyone should use PGP).
But PGP is useful if both sender and receiver agree to use PGP.
> But PGP is useful if both sender and receiver agree to use PGP.
Anecdotally: this works until you add a third person who responds to the thread in plain text, with everything threaded beneath. Or when you do that by accident.
Applied cryptographers will tell you to use Signal or any other E2EE chat.
Signal isn’t owned by the users and independent of third parties the way PGP/GPG is so regardless of who will or won’t suggest a substitute it’s not.
9 replies →
>PGP itself is a security liability in almost every system that hosts it.
Elaborate
Secure messaging is its own (increasingly well-defined) cryptographic problem. Group secure messaging is a distinct problem with its own cryptography. Backups are their own problem with their own constraints. Package signatures are their own problem.
There isn't one cryptosystem that does all these things. For messaging you want a carefully-defined notion of forward secrecy and post-compromise recovery, along with a careful decision about repudiation/non-repudation (1990s cryptography doctrine would suggest you just always want nonrepudiabilty, which turns out to be disastrous for privacy). For backup, you want deduplication and content addressing. For packages, you want transparency logs. You almost never want long-lived keys, but you often want identify binding.
PGP solves basically none of these problems, and offers instead a 1998 API (I'm not kidding, I thought about what year to pin it at) to basic cryptography primitives.
https://gpg.fail/
https://www.latacora.com/blog/2019/07/16/the-pgp-problem
Recommendations: https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/
We don't need to keep elaborating or re-litigating the same discussion. The PGP idea of "one tool to rule them all" is a terrible cryptography design, and the world is better off the sooner we stop trying to make it work.
Obligatory response to "The PGP Problem":
* https://articles.59.ca/doku.php?id=pgpfan:tpp
By what I saw, there wasn't really anything anyone would care about in https://gpg.fail/ . The GnuPG problem actually declined to respond to some of them.
3 replies →
I guess the code base has really become a bit messy over time with all that parsing and different crypto algorithms. But the attack surface can be significantly reduced by using sq or even better stateless sqop.
Can you elaborate? I know of commercial softwares that use it still where only the softer has the private key. Seems to work pretty well, but this is slightly out of my normal scope.