> In 2013, an article on "Zimmermann's Law" quoted Phil Zimmermann as saying "The natural flow of technology tends to move in the direction of making surveillance easier"
There's a good idea in PGP, and a very bad one. The good idea --- and PGP genuinely deserves credit here --- is end-user, consumer-facing strong cryptography tools. That's now universally accepted and has been for decades. The bad idea is a tool with PGP's design, of "cryptographic jack-of-all-trades". PGP's design has aged like milk, and PGP itself is a security liability in almost every system that hosts it.
PGP the packet formats, PGP the tool(s), OpenPGP the specs, GnuPG the tool, GnuPG the library; or any of the other libraries? Web of Trust? All of it? None of the above?
Any time this topic comes up, here and elsewhere, I find that most discussions revolve around different understandings and misunderstandings what people mean when they say “PGP”, and rarely lead to anything beyond that. - no this is PGP no you’re wrong that is PGP and so on and on…
All of those things are liabilities (I read them carefully and mentally checked them off one by one; I'm not just being rhetorical). I wrote a sibling comment going into more detail, but happy to answer questions.
Another thing is also that email itself was not designed with encryption in mind and because it is decentralized and backwards-compatible it is hard to enforce new rules (everyone should use PGP).
But PGP is useful if both sender and receiver agree to use PGP.
> But PGP is useful if both sender and receiver agree to use PGP.
Anecdotally: this works until you add a third person who responds to the thread in plain text, with everything threaded beneath. Or when you do that by accident.
Applied cryptographers will tell you to use Signal or any other E2EE chat.
Signal's has buildable source code on the client side and all. However, the server code is closed source and the developers have made disquieting changes like uploading most users' contact lists to the server protected only by Intel SGX that is known to have vulnerabilities exploitable by a nation-scale actor.
The point of E2EE is that you don't need to trust the server that you're talking through. A secure E2EE scheme is secure in the presence of an actively malicious server.
I think SGX is a red herring in this context. You can find it risky or not, but it's (1) not material to Signal's E2EE property, and (2) materially better than email, which sends all contact metadata in plaintext, regardless of whether you try and encrypt your message bodies. Bringing it up in this context seems like a category error.
Secure messaging is its own (increasingly well-defined) cryptographic problem. Group secure messaging is a distinct problem with its own cryptography. Backups are their own problem with their own constraints. Package signatures are their own problem.
There isn't one cryptosystem that does all these things. For messaging you want a carefully-defined notion of forward secrecy and post-compromise recovery, along with a careful decision about repudiation/non-repudation (1990s cryptography doctrine would suggest you just always want nonrepudiabilty, which turns out to be disastrous for privacy). For backup, you want deduplication and content addressing. For packages, you want transparency logs. You almost never want long-lived keys, but you often want identify binding.
PGP solves basically none of these problems, and offers instead a 1998 API (I'm not kidding, I thought about what year to pin it at) to basic cryptography primitives.
I guess the code base has really become a bit messy over time with all that parsing and different crypto algorithms. But the attack surface can be significantly reduced by using sq or even better stateless sqop.
We don't need to keep elaborating or re-litigating the same discussion. The PGP idea of "one tool to rule them all" is a terrible cryptography design, and the world is better off the sooner we stop trying to make it work.
By what I saw, there wasn't really anything anyone would care about in https://gpg.fail/ . The GnuPG problem actually declined to respond to some of them.
The biggest issue of using PGP was using PGP. You were pretty nerdy to be on the internet back then, but even then using PGP was beyond what the majority of people wanted to do. Exchanging keys was problematic. Writing text in one app, encrypting in another app, copying encrypted back to an email was just tiresome.
I'm still glad that it existed as its mere existence seems to have pushed things in the right direction as far as protecting everyone's ability to use encryption if they chose. It just never became the panacea it was envisioned to be.
One big usability issue these days is that PGP identities come in the form of a file. Lots of people don't have the concept of that anymore.
Dunno that things have gotten much better over the years. End to end encryption is still fairly unusable to most. I think that rather than spending so much time on the cryptography we should instead work on a E2EE usability standard. Having everyone doing their own thing with respect to usability is not working out.
The term E2EE has been subverted. Apps like WhatsApp claiming to be E2EE, but only if you actually enable it, so that people think they are being encrypted when they are not does not help. ProtonMail falls into this as well where allowing email to non-encrypted addresses means there is no encryption. It's obvious to some, but not so for the majority. Very few people read the caveats that WhatsApp and ProtonMail provide.
ASCII armored exports suitable for plain text copying and pasting and inclusion in other documents and messages seem to be the norm for sharing. Keys are referred to by keyid or email. To the key database, files seem more like an implementation detail.
It provides the tools necessary to implement a simpler workflow.
There were (are? it's been a while) many PGP users on the various darkweb markets. It was great fun teaching people to use it and actually having a community to use it with.
It was pretty awkward to later emerge as the PGP expert at work. I was at that time a bit shy about explaining how I got so comfortable with it.
The fundamental idea of technology such as PGP is that the percentage of stuff worth finding for the authorities needs to be really low. Ie. an incredible amount of "legitimate" innocent traffic needs to be flowing through the technology.
Otherwise, anyone who is using it at all will get court ordered and then, with our current system, you just lose.
Tor solves this by making traffic entirely homogenous such that any "it could be anyone" and by making nodes extraordinarily easy to host (such that any nerd can just leave one running 24/7). Even so there are way too few nodes.
But PGP-over-email is way too metadata leaky, and if you're doing anything that actually has a threat model, you need PGP-over-email to be itself common.
To be honest: I keep hearing that PGP was / is difficult to use. That couldn‘t be further from the truth - but somehow it has become an urban myth. From the very first versions that I used on my first Mac up to GPG Mail or Proton Mail I never encountered any significant difficulties and could successfully exchange messages with my peers - both in business and private contexts.
I once had a chat with a security professor who had decided to try to get his group to use encrypted email for all of their communications. And they just couldn't get mailing lists working right with encrypted email.
In general, a session/thread ephemeral key pair is exchanged with the participants, and only each users private origin signing validates each sender sections. Since the signatures are passively checked, it does not need redone after each append operation.
Thus, participants are pooled under 1 time constrained key exchange, participants sections origins are signed/time-stamped, and the ciphertext expires on a schedule.
Why? so at some future time side-channel key exfiltration can't be used to data mine the entire history of past tapped conversations/ciphertext. Even if a private signing key is stolen, it is difficult to rebuild the lost ephemeral key session.
My eyes glazed over reading that. I feel like 30 years of internet has proven one thing: the simplest solution always wins. PGP is many things, but simple and obvious are not among them.
> In 2013, an article on "Zimmermann's Law" quoted Phil Zimmermann as saying "The natural flow of technology tends to move in the direction of making surveillance easier"
A well-intentioned ideal from a bygone era.
Good ideas demand to be free. =3
There's a good idea in PGP, and a very bad one. The good idea --- and PGP genuinely deserves credit here --- is end-user, consumer-facing strong cryptography tools. That's now universally accepted and has been for decades. The bad idea is a tool with PGP's design, of "cryptographic jack-of-all-trades". PGP's design has aged like milk, and PGP itself is a security liability in almost every system that hosts it.
PGP the packet formats, PGP the tool(s), OpenPGP the specs, GnuPG the tool, GnuPG the library; or any of the other libraries? Web of Trust? All of it? None of the above?
Any time this topic comes up, here and elsewhere, I find that most discussions revolve around different understandings and misunderstandings what people mean when they say “PGP”, and rarely lead to anything beyond that. - no this is PGP no you’re wrong that is PGP and so on and on…
PGP: The flamethrower (kids love this one)
All of those things are liabilities (I read them carefully and mentally checked them off one by one; I'm not just being rhetorical). I wrote a sibling comment going into more detail, but happy to answer questions.
Each of these bad in a different and exciting way, if your idea of exciting is reading mailing list threads.
(The idea of trust networks is not bad. But PGP’s implementation of them is bad.)
Another thing is also that email itself was not designed with encryption in mind and because it is decentralized and backwards-compatible it is hard to enforce new rules (everyone should use PGP).
But PGP is useful if both sender and receiver agree to use PGP.
> But PGP is useful if both sender and receiver agree to use PGP.
Anecdotally: this works until you add a third person who responds to the thread in plain text, with everything threaded beneath. Or when you do that by accident.
Applied cryptographers will tell you to use Signal or any other E2EE chat.
Signal isn’t owned by the users and independent of third parties the way PGP/GPG is so regardless of who will or won’t suggest a substitute it’s not.
Why is “owned by the users” (whatever that means) the quality you’re testing cryptographic protocols against?
Signal's has buildable source code on the client side and all. However, the server code is closed source and the developers have made disquieting changes like uploading most users' contact lists to the server protected only by Intel SGX that is known to have vulnerabilities exploitable by a nation-scale actor.
The point of E2EE is that you don't need to trust the server that you're talking through. A secure E2EE scheme is secure in the presence of an actively malicious server.
I think SGX is a red herring in this context. You can find it risky or not, but it's (1) not material to Signal's E2EE property, and (2) materially better than email, which sends all contact metadata in plaintext, regardless of whether you try and encrypt your message bodies. Bringing it up in this context seems like a category error.
XMPP + omemo
>PGP itself is a security liability in almost every system that hosts it.
Elaborate
Secure messaging is its own (increasingly well-defined) cryptographic problem. Group secure messaging is a distinct problem with its own cryptography. Backups are their own problem with their own constraints. Package signatures are their own problem.
There isn't one cryptosystem that does all these things. For messaging you want a carefully-defined notion of forward secrecy and post-compromise recovery, along with a careful decision about repudiation/non-repudation (1990s cryptography doctrine would suggest you just always want nonrepudiabilty, which turns out to be disastrous for privacy). For backup, you want deduplication and content addressing. For packages, you want transparency logs. You almost never want long-lived keys, but you often want identify binding.
PGP solves basically none of these problems, and offers instead a 1998 API (I'm not kidding, I thought about what year to pin it at) to basic cryptography primitives.
I guess the code base has really become a bit messy over time with all that parsing and different crypto algorithms. But the attack surface can be significantly reduced by using sq or even better stateless sqop.
https://gpg.fail/
https://www.latacora.com/blog/2019/07/16/the-pgp-problem
Recommendations: https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/
We don't need to keep elaborating or re-litigating the same discussion. The PGP idea of "one tool to rule them all" is a terrible cryptography design, and the world is better off the sooner we stop trying to make it work.
Obligatory response to "The PGP Problem":
* https://articles.59.ca/doku.php?id=pgpfan:tpp
By what I saw, there wasn't really anything anyone would care about in https://gpg.fail/ . The GnuPG problem actually declined to respond to some of them.
The biggest issue of using PGP was using PGP. You were pretty nerdy to be on the internet back then, but even then using PGP was beyond what the majority of people wanted to do. Exchanging keys was problematic. Writing text in one app, encrypting in another app, copying encrypted back to an email was just tiresome.
I'm still glad that it existed as its mere existence seems to have pushed things in the right direction as far as protecting everyone's ability to use encryption if they chose. It just never became the panacea it was envisioned to be.
One big usability issue these days is that PGP identities come in the form of a file. Lots of people don't have the concept of that anymore.
Dunno that things have gotten much better over the years. End to end encryption is still fairly unusable to most. I think that rather than spending so much time on the cryptography we should instead work on a E2EE usability standard. Having everyone doing their own thing with respect to usability is not working out.
The term E2EE has been subverted. Apps like WhatsApp claiming to be E2EE, but only if you actually enable it, so that people think they are being encrypted when they are not does not help. ProtonMail falls into this as well where allowing email to non-encrypted addresses means there is no encryption. It's obvious to some, but not so for the majority. Very few people read the caveats that WhatsApp and ProtonMail provide.
ASCII armored exports suitable for plain text copying and pasting and inclusion in other documents and messages seem to be the norm for sharing. Keys are referred to by keyid or email. To the key database, files seem more like an implementation detail.
It provides the tools necessary to implement a simpler workflow.
There were (are? it's been a while) many PGP users on the various darkweb markets. It was great fun teaching people to use it and actually having a community to use it with.
It was pretty awkward to later emerge as the PGP expert at work. I was at that time a bit shy about explaining how I got so comfortable with it.
The fundamental idea of technology such as PGP is that the percentage of stuff worth finding for the authorities needs to be really low. Ie. an incredible amount of "legitimate" innocent traffic needs to be flowing through the technology.
Otherwise, anyone who is using it at all will get court ordered and then, with our current system, you just lose.
Tor solves this by making traffic entirely homogenous such that any "it could be anyone" and by making nodes extraordinarily easy to host (such that any nerd can just leave one running 24/7). Even so there are way too few nodes.
But PGP-over-email is way too metadata leaky, and if you're doing anything that actually has a threat model, you need PGP-over-email to be itself common.
To be honest: I keep hearing that PGP was / is difficult to use. That couldn‘t be further from the truth - but somehow it has become an urban myth. From the very first versions that I used on my first Mac up to GPG Mail or Proton Mail I never encountered any significant difficulties and could successfully exchange messages with my peers - both in business and private contexts.
I once had a chat with a security professor who had decided to try to get his group to use encrypted email for all of their communications. And they just couldn't get mailing lists working right with encrypted email.
The sender has to encrypt with everyones individual key wonder why he couldn't get it to work.
In general, a session/thread ephemeral key pair is exchanged with the participants, and only each users private origin signing validates each sender sections. Since the signatures are passively checked, it does not need redone after each append operation.
Thus, participants are pooled under 1 time constrained key exchange, participants sections origins are signed/time-stamped, and the ciphertext expires on a schedule.
Why? so at some future time side-channel key exfiltration can't be used to data mine the entire history of past tapped conversations/ciphertext. Even if a private signing key is stolen, it is difficult to rebuild the lost ephemeral key session.
Have a nice day. =3
My eyes glazed over reading that. I feel like 30 years of internet has proven one thing: the simplest solution always wins. PGP is many things, but simple and obvious are not among them.