Re: How difficult is it to break the OpenPGP 40 character long fingerprint?

On 1 April 2013 22:50, David Tomaschik wrote: > On Mon, Apr 1, 2013 at 10:46 AM, Daniel Kahn Gillmor < > d...@fifthhorseman.net> wrote: > >> On 04/01/2013 12:24 PM, adrelanos wrote: >> >> > gpg uses only(?) 40 chars for the fingerprint. >> > (I mean the output of: gpg --fingerprint --keyid-format

Re: How difficult is it to break the OpenPGP 40 character long fingerprint?

On 4/1/2013 6:38 PM, Melvin Carvalho wrote: > differential path attack. On 8 November 2010, he claimed he had a fully > working near-collision attack against full SHA-1 working with an > estimated complexity equivalent to 257.5 SHA-1 compressions. He > estimates this attack can be extended to a ful

Re: How difficult is it to break the OpenPGP 40 character long fingerprint?

On Mon, Apr 1, 2013 at 3:38 PM, Melvin Carvalho wrote: > > > > On 1 April 2013 22:50, David Tomaschik wrote: > >> On Mon, Apr 1, 2013 at 10:46 AM, Daniel Kahn Gillmor < >> d...@fifthhorseman.net> wrote: >> >>> On 04/01/2013 12:24 PM, adrelanos wrote: >>> >>> > gpg uses only(?) 40 chars for the fi

Re: How difficult is it to break the OpenPGP 40 character long fingerprint?

On Mon, Apr 1, 2013 at 10:46 AM, Daniel Kahn Gillmor wrote: > On 04/01/2013 12:24 PM, adrelanos wrote: > > > gpg uses only(?) 40 chars for the fingerprint. > > (I mean the output of: gpg --fingerprint --keyid-format long.) > > this is a 160-bit SHA-1 digest of the public key material and the > cre

Re: The Lord of the Keys

On 03/31/2013 01:41 PM, Ken Kundert wrote: I am currently using gpg-agent to hold both my gpg and ssh keys. I use two ssh keys, which means that when I log in I have to give up to four passphrases to unlock all of my keys. Given that gpg-agent is primarily a labor-saving device, I am wondering if

Re: The Lord of the Keys

On Sun, Mar 31, 2013 at 1:41 PM, Ken Kundert wrote: > I am currently using gpg-agent to hold both my gpg and ssh keys. I use two > ssh > keys, which means that when I log in I have to give up to four passphrases > to > unlock all of my keys. Given that gpg-agent is primarily a labor-saving > devic

Re: How difficult is it to break the OpenPGP 40 character long fingerprint?

On 04/01/2013 01:46 PM, Daniel Kahn Gillmor wrote: > Predicting computing power or the state of mathematics itself 100 or > 1000 years into the future seems like a dubious proposition. Yes and no. We're not going to get around the Margolus-Levitin limit (you can't flip a bitstate in faster than h

Re: How difficult is it to break the OpenPGP 40 character long fingerprint?

On 04/01/2013 12:24 PM, adrelanos wrote: > How difficult, i.e. how much computing power and time is required to > create a key, which matches the very same fingerprint? > > Isn't 40 chars a bit weak? (Nothing I am writing here is sarcastic or non-factual.) At present, the only way to do a preima

Re: The Lord of the Keys

Am So 31.03.2013, 13:41:59 schrieb Ken Kundert: > I am currently using gpg-agent to hold both my gpg and ssh keys. I use two > ssh keys, which means that when I log in I have to give up to four > passphrases to unlock all of my keys. You probably need gpg-preset-passphrase for that. But I have nev

Re: smartcard: transferring to another account

On 31/03/13 23:16, Anonymous wrote: > account 'B' can access the card, but I guess it is missing some type of > "stub" gnupg uses to mark the keys on the card? Importing the public key /should/ be enough, and when GnuPG sees the smartcard, it will create the corresponding stub.[1] So there is som

Re: How difficult is it to break the OpenPGP 40 character long fingerprint?

On 04/01/2013 12:24 PM, adrelanos wrote: > gpg uses only(?) 40 chars for the fingerprint. > (I mean the output of: gpg --fingerprint --keyid-format long.) this is a 160-bit SHA-1 digest of the public key material and the creation date, with a bit of boilerplate for formatting. This is not gpg-sp

How difficult is it to break the OpenPGP 40 character long fingerprint?

Hi! gpg uses only(?) 40 chars for the fingerprint. (I mean the output of: gpg --fingerprint --keyid-format long.) How difficult, i.e. how much computing power and time is required to create a key, which matches the very same fingerprint? Isn't 40 chars a bit weak? Are there plans to provide a l

smartcard: transferring to another account

Hello, I have a smart card with several keys. All the keys are 2048 bits due to the mentioned gnupg limitations. All the keys are set up under unix account 'A'. I would like to use one of those keys under unix account 'b'. I can export the public key, but clearly not the private key. I have i

The Lord of the Keys

I am currently using gpg-agent to hold both my gpg and ssh keys. I use two ssh keys, which means that when I log in I have to give up to four passphrases to unlock all of my keys. Given that gpg-agent is primarily a labor-saving device, I am wondering if it would be possible to configure it to a

Re: Why does gpg use so much entropy from /dev/random?

On 31 March 2013 18:33, Hauke Laging wrote: > strace -e trace=open,read gpg --armor --gen-random 0 16 > [...] > open("/dev/urandom", O_RDONLY) = 3 > read(3, "\332\376J\314\1[\357\n7ee\303\372\3555h", 16) = 16 > > > strace -e trace=open,read gpg --armor --gen-random 1 16 > [...] > open("/d

Re: Why does gpg use so much entropy from /dev/random?

Am Mo 01.04.2013, 10:53:02 schrieb Philip Potter: > Can you set the quality level for other generation commands, or just for > --gen-random? None that I know of. Doesn't make sense elsewhere IMHO, too. Hauke -- ☺ PGP: 7D82 FB9F D25A 2CE4 5241 6C37 BF4B 8EEF 1A57 1DF5 (seit 2012-11-04) http://ww

Re: Why does gpg use so much entropy from /dev/random?

Thanks very much, I didn't know about the --gen-random command and the quality level option. I'll have a look at the source code and see if I can understand further. Can you set the quality level for other generation commands, or just for --gen-random? On 31 March 2013 18:33, Hauke Laging wrote