← Feed

Posts

• View post

  @jonah this is definitely a hard time to feel hopeful about tech. My silver linings perspective is that we're collectively getting a lot of new clarity about what we disagree with, and what world we'd prefer to inhabit instead. Some of the "evils" are new, but many have been here a long time, and we've just gotten better at seeing them with a critical eye. Maybe this depressing moment is a necessary intermediate step towards making a better tech world...

• View post

  Apparently the so-called "schism" in #OpenPGP is over. Context: In 2022, an email to the IETF OpenPGP working group list, titled "a new draft overlapping the WG draft", noted that one implementation (GnuPG) seemed to reject the draft that is now RFC 9580: https://mailarchive.ietf.org/arch/msg/openpgp/PWp3ZcZ_qnDNLhuT-zR7gA2ddeg/ Today, the author of #GnuPG signaled on the IETF list that he intends to implement support for RFC 9580 and draft-ietf-openpgp-nist-bp-comp: http...

• View post

  Over the last half week, I've implemented very barebones #OpenPGP card support in @minipgp6@floss.social Support is limited to Ed25519 and X25519 (since that's the intersection of what minipgp supports and what current cards support). As expected, there is no fundamental obstacle that prevents use of existing OpenPGP card devices with v6 keys. #rfc9580

• View post

  The openpgp-card-state crate now has a new "ephemeral" backend: https://codeberg.org/openpgp-card/state/#ephemeral-interactive-input-with-persistence-and-expiry This combines the defensiveness of unpersisted pinentry with the convenience of caching (in the Linux kernel credential store, for a configurable duration). New releases of https://crates.io/crates/openpgp-card-tool-git, https://crates.io/crates/openpgp-card-ssh-agent, https://crates.io/crates/rsop-oct support this n...

• View post

  Regular PSA reminder: While GnuPG 2.5.x implements hybrid PQC encryption based on ML-KEM, just like https://datatracker.ietf.org/doc/draft-ietf-openpgp-pqc/, GnuPG's implementation is entirely incompatible with the IETF-specified format, which all other libraries are implementing. Both serialization and the KEM combiners differ. The bottom line is that anyone who wants to use vendor-agnostic PQC with OpenPGP should *avoid GnuPG's PQC key formats*. This is all exceedingly unfor...

• View post

  I just released a first draft version of #minipgp6 https://floss.social/@minipgp6/116500687374282691 minipgp6 is an intentionally small #OpenPGP library stack. It implements v6 formats from https://www.rfc-editor.org/rfc/rfc9580 and #PQC composite key algorithms from https://datatracker.ietf.org/doc/draft-ietf-openpgp-pqc/ The complete library stack in this release adds up to ~5k LOC. It interoperates with all modern OpenPGP libraries: https://codeberg.org/minipgp6/minipgp6#interop A SOP CL...

• View post

  RE: https://fosstodon.org/@foss_north/116476608857157107 Yay for @dvzrv 's tireless(*) work towards modernizing how OpenPGP is used in distro contexts (including in Arch Linux). I've spent some time last year hacking on https://devblog.archlinux.page/2026/verify-arch-linux-artifacts-using-voa-openpgp/ with David, which was a great time. VOA is the other side of the coin to Signstar - the former verifies signatures, while the latter produces them. --- (*) Although I do suspec...

• View post

  I just released version 0.1.9 of rsop-oct, a stateless #OpenPGP ("SOP") CLI tool for use with OpenPGP card hardware devices: https://crates.io/crates/rsop-oct/ Like its sibling project #rsop, rsop-oct is based on @rpgp This version improves error handling and reporting in some cases, in particular when a suitable card is not found, or the User PIN for a card is not available. For more on #SOP, see https://datatracker.ietf.org/doc/draft-dkg-openpgp-stateless-cli/ #PGP #GnuP...

• View post

  The initial plan for minipgp6 was to support only the "mandatory to implement" algorithms from RFC 9580. In terms of public key algorithms, this would mean: only Ed25519 and X25519. However, in the meantime, draft-ietf-openpgp-pqc has made much progress - IETF-standardized PQC support in #OpenPGP is going to get rolled out in various places soon. So I'm amending the plan: minipgp will optionally support the two "mandatory" composite #PQC algorithms "ML-KEM-768+X25...

• View post

  I just released version 0.1.7 of rsop-oct, a stateless #OpenPGP ("SOP") CLI tool for use with OpenPGP card hardware devices: https://crates.io/crates/rsop-oct/ Like its sibling project #rsop, rsop-oct is based on @rpgp This update adds (initial) support for the SOP command 'update-key'. This command allows extending the expiration times of components of an OpenPGP certificate using a primary key that is stored on an OpenPGP card device. For more on #SOP, se...

• View post

  A new report (commissioned by the German BSI) outlines the recent evolution of the #OpenPGP standard, including the new RFC 9580 and PQC drafts, as well as the spinoff "LibrePGP" draft that the GnuPG project writes. PDF: https://github.com/crypto-security-tools/OpenPGP-LibrePGP-comparison/releases/download/v1.4/opgp-lpgp-comp.pdf (Announcement email: https://mailarchive.ietf.org/arch/msg/openpgp/2g_rjYBqwqKZE6OEgjNb0bFo098/) Note that the document contains a one-page &qu...

• View post

  The https://freepg.org/ project maintains patches against #GnuPG with the goal of closer adherence to the IETF #OpenPGP spec. One currently open question is if/how draft-ietf-openpgp-pqc support could be realistically added to #FreePG I've started https://codeberg.org/freepg/freepg-draft-ietf-openpgp-pqc first of all as a notes-to-self repo for a (presumably very slow and long-term) side quest to explore this problem. Specifically, the goal would be adding support for v4 ML-KEM-768+X2...