Re: Why would I want S/MIME?

2016-09-12 Thread Aaron Toponce
On Mon, Sep 12, 2016 at 01:31:38PM -0500, Anthony Papillion wrote: > I understand what S/MIME is and that it's probably the easiest crypto > solution for most email users. But why would someone comfortable with > GnuPG use it? Does it offer any advantages over traditional PGP keys? If > I understan

Re: Thoughts on Keybase

2014-12-29 Thread Aaron Toponce
On Mon, Dec 15, 2014 at 01:40:22PM -0500, Robert J. Hansen wrote: > Keybase (https://keybase.io) is trying to solve the Web of Trust problem in > a new way. They're currently in beta, but I was able to snag an invitation. > (I have no invites to give out, unfortunately.) FWIW, I have 3 invites. I

Re: Keysigning

2014-12-02 Thread Aaron Toponce
On Tue, Dec 02, 2014 at 10:23:13AM -0700, Aaron Toponce wrote: > Yes. You can get me through Tox. My Tox ID is: > > 76AC69FEB7DA042DFD75F30574CEE3C6498DF9DD766E1D78FC5CB4693CA10BD381F696 Hmm. It seems to have been truncated in the paste. The actual

Re: Keysigning

2014-12-02 Thread Aaron Toponce
On Tue, Dec 02, 2014 at 01:57:13PM +0530, Robin Mathew Rajan wrote: > Where can I get my keys signed? Does here anyone provide keysigning services > through video conference? :) Yes. You can get me through Tox. My Tox ID is: 76AC69FEB7DA042DFD75F30574CEE3C6498DF9DD766E1D78FC5CB4693CA10BD381F696

Re: Tweeting for GnuPG

2014-11-11 Thread Aaron Toponce
On Wed, Nov 05, 2014 at 09:21:14PM +0100, Werner Koch wrote: > I am looking for one or two people who would like to fill the @gnupg > Twitter account with some life. > > I am not one of those short message people but Twitter seems to be a big > deal these days. Thus if someone would be interested

Re: Update on USG, Software, and the First Amendment

2014-10-27 Thread Aaron Toponce
On Mon, Oct 27, 2014 at 03:51:04PM -0400, Robert J. Hansen wrote: > I just don't want to ask my friend to put together something on the > subject and then discover there's no interest in it -- it seems > disrespectful to Professor Johnson. :) I think there will be great interest on the list for i

Re: Fwd: GNU hackers discover HACIENDA government surveillance and give us a way to fight back

2014-08-21 Thread Aaron Toponce
On Fri, Aug 22, 2014 at 12:46:38AM +0200, Gabriel Niebler wrote: > On the contrary, IMO this sort of thing is fully encompassed by the > word surveillance, at least as far as I have always understood it. > Otherwise any surveillance camera installed in a public or publicly > accessible place would

Re: Fwd: It's time for PGP to die.

2014-08-18 Thread Aaron Toponce
On Mon, Aug 18, 2014 at 12:24:43PM -0400, Mark H. Wood wrote: > Sure, it does encrypt mail. My SMTP has mail from me to deliver. It > contacts an SMTP that it thinks can get the mail closer to its > addressee. My SMTP sends STARTTLS, the receiving SMTP agrees, they > handshake, and the rest of t

Re: Fwd: It's time for PGP to die.

2014-08-18 Thread Aaron Toponce
On Mon, Aug 18, 2014 at 09:59:33AM -0400, Mark H. Wood wrote: > Perhaps it would be a start if sites providing SMTP would turn on > STARTTLS. STARTTLS does not encrypt mail. It only provides safe passage over the network. It is also client/server encrypted and decrypted. Thus, an administrator wit

Re: ICMP

2014-08-15 Thread Aaron Toponce
On Fri, Aug 15, 2014 at 12:54:29PM -0400, Robert J. Hansen wrote: > >Blocking ICMP is not a network misconfiguration at all. > > Whether it's a misconfiguration depends entirely on whether the > administrator intends this behavior. I meant "Blocking ICMP" is a deliberate act by the administrator,

ICMP (was: Re: keys.gnupg.net - Refresh all public keys never completes in) Enigmail, some servers down?

2014-08-15 Thread Aaron Toponce
On Thu, Aug 14, 2014 at 05:13:08PM +0100, OmegaPhil wrote: > Fair point, although that would be a network misconfiguration as > ping/ICMP is required for network troubleshooting, packet fragmentation > stuff etc (for reference I'm testing from a dedicated line that I control). Blocking ICMP is not

Re: public key E6602099 is 131772146 seconds newer than the signature

2014-06-18 Thread Aaron Toponce
On Wed, Jun 18, 2014 at 07:28:32AM -0600, Aaron Toponce wrote: > As per my understanding of the gpg(1) manpage, '--ignore-time-conflicts' > should > supress messages such as the one in the subject. Er, '--ignore-time-conflict'. Singular, not plural. -- . o .

public key E6602099 is 131772146 seconds newer than the signature

2014-06-18 Thread Aaron Toponce
As per my understanding of the gpg(1) manpage, '--ignore-time-conflicts' should supress messages such as the one in the subject. However, that doesn't seem to be the case: http://ae7.st/p/2u6. It appears that only when redirecting STDERR to /dev/null is it supressed. Is this expected behavior, or a

Re: "gpg --with-fingerprint $FILE" is not listing the keyfingerprint in some cases

2014-05-14 Thread Aaron Toponce
On Wed, May 14, 2014 at 06:26:31PM +0200, Werner Koch wrote: > > Ah. Interesting. Should I file a proper bug against GnuPG then? > > Please do that. Done. https://bugs.g10code.com/gnupg/issue1640 Thanks, -- . o . o . o . . o o . . . o . . . o . o o o . o . o o . . o o o o . o

Re: "gpg --with-fingerprint $FILE" is not listing the keyfingerprint in some cases

2014-05-14 Thread Aaron Toponce
On Tue, May 13, 2014 at 11:30:21PM -0400, David Shaw wrote: > Looks like a bug. Note that on each of the keys that didn't work there is a > direct signature on the key. This is not very common, and is usually used > for a designated revoker (i.e. "I permit so-and-so to revoke my key for me"). > I

Re: "gpg --with-fingerprint $FILE" is not listing the keyfingerprint in some cases

2014-05-14 Thread Aaron Toponce
On Wed, May 14, 2014 at 11:32:07AM +1000, Fraser Tweedale wrote: > This behaviour also occurs for me in 2.0.22. Instead of exporting > the key, you could use --list-keys, which works for me: Yeah, I'm not interesting in running it from the keyring, as I am assuming that the key is not imported, b

"gpg --with-fingerprint $FILE" is not listing the keyfingerprint in some cases

2014-05-13 Thread Aaron Toponce
I don't know if this is a bug, or if I am doing something wrong, so I might as well ask here. I ran the following command from my terminal, and cannot retrieve the fingerprint from the file: $ gpg --output 0xBB065B251FF4945B.gpg --export 0xBB065B251FF4945B $ gpg --with-colons --with-finger

Re: ideal.dll // fixing thread breaking

2012-07-01 Thread Aaron Toponce
On Fri, Jun 29, 2012 at 01:45:17PM -0400, Robert J. Hansen wrote: > IMO, if your client is showing correct PGP/MIME signatures on this list, > you should file a defect report about your client. The message has been > changed in transit and is no longer in the exact same state as it was > when the

Re: idea.dll

2012-06-27 Thread Aaron Toponce
On Tue, Jun 26, 2012 at 01:12:12AM -0400, ved...@nym.hush.com wrote: > it will be interesting to see if V4 keys will be gracefully > abandoned as SHA1 becomes as broken as MD5, > > or if there will be die-hards holding onto they their V4 keys no > matter what ... Please fix your client. I don'

Re: ideal.dll

2012-06-27 Thread Aaron Toponce
On Mon, Jun 25, 2012 at 08:44:11PM +0200, Werner Koch wrote: > On Mon, 25 Jun 2012 20:12, aaron.topo...@gmail.com said: > > So, if the system can be improved by removing support for PGP2, which > > includes cleaning up code, squashing bugs, and tightening security, then > > why is it still around?

Re: ideal.dll

2012-06-25 Thread Aaron Toponce
On Mon, Jun 25, 2012 at 12:11:57AM +0200, Werner Koch wrote: > I am telling for more than a decade that PGP 2 should not be used > anymore. The rationale for this was that OpenPGP is a standard and > fixes great many problems of PGP 2. GnuPG supports PGP 2 only because > this provides a way to mi

Re: ideal.dll

2012-06-22 Thread Aaron Toponce
On Fri, Jun 22, 2012 at 10:21:35AM -0400, ved...@nym.hush.com wrote: > vulnerability in that their fingerprint mechanism is trivially > gamable, > so long keyid collisions are easy. [snip] Please fix your mail client. It is breaking threads. Thanks, -- . o . o . o . . o o . . . o . .

Re: GPG with GPUs

2012-06-18 Thread Aaron Toponce
On Sun, Jun 17, 2012 at 07:26:27PM +0200, Hauke Laging wrote: > This are the result (with a caches passphrase, of course). It's the same for > a > zeros file and a urandom file. And this is on a power efficient CPU... > (E-450, > which I guess doesn't have AES acceleration) probably without par

Re: GPG with GPUs

2012-06-17 Thread Aaron Toponce
On Sat, Jun 16, 2012 at 07:54:46PM +0200, Hauke Laging wrote: > Are these files huge? It's hard for me to believe that this takes seconds. > What I would easily believe is that the system gets an entropy problem. The > delay would not be related to CPU performance then. So maybe a hardware RNG >

GPG with GPUs

2012-06-16 Thread Aaron Toponce
I'm curious what progress, if any, has been made towards supporting GPUs for encryption, decryption, signatures and verifications. I recently just purchased two Zotac 32-bit PCI cards with 96 CUDA cores (I'm out of PCIe slots) for the sole purpose of GPGPU research and sandboxing. We use GPG at wo

Re: Testing GPG EMail encryption

2012-05-25 Thread Aaron Toponce
On Wed, May 23, 2012 at 08:07:54PM +0100, da...@gbenet.com wrote: > Openpgp/enigmail does not support gpg2 unless one has installed gpg > 1.4.11 - but I no longer trust Openpgp/enigmail to do anything. That's unfortunate. While I'm mostly a Mutt user these days, I have Debian Icedove installed wit

Re: using this list

2012-03-27 Thread Aaron Toponce
On Tue, Mar 27, 2012 at 06:46:42AM +, auto15963...@hushmail.com wrote: > I noticed that this list is also available on gmane as > "gmane.comp.encryption.gpg.user", which allows retrieving the > messages in a newsreader in lieu of in email. I prefer the > newsreader format. Is there any reason

Re: gnupg and excel sending email.

2012-03-22 Thread Aaron Toponce
On Thu, Mar 22, 2012 at 09:24:06AM -0600, Eric wrote: > After installing gpg4win-2.1.0 the email button from excel (2003) > will not send out mail. It will put the mail in my Outlook inbox > instead of sending it. > Can't forward the email because it hammers the formatting. Is there > a fix or do

Re: Using root CAs as a trusted 3rd party

2012-01-21 Thread Aaron Toponce
On Sat, Jan 21, 2012 at 10:50:11PM +0100, Gregor Zattler wrote: > IMHO by signing a key you make a statement about the connection > between a person or owner and the user id you sign, saying "I > somehow convinced myself that user owns this key". This only > makes sense if you have some insight in

Re: Using root CAs as a trusted 3rd party

2012-01-21 Thread Aaron Toponce
On Sat, Jan 21, 2012 at 02:47:25PM -0500, Thomas Harning Jr. wrote: > That process seems pretty reasonable, assuming the CA is reputable. Even > better if you keep track of the SSL cert to keep track of breaches and the > like. The idea is only to casually trust that a key belongs to a person. If

Using root CAs as a trusted 3rd party

2012-01-21 Thread Aaron Toponce
I just signed an OpenPGP key with cert level 0x12 (casual checking) given the following scenario: * A PGP key was signed by an SSL certificate that was signed by a root CA * I verified that the signature was indeed from that root CA. * I striped the signature, and imported the PG

Re: Best Way to announce a Key Party

2012-01-16 Thread Aaron Toponce
On Mon, Jan 16, 2012 at 02:57:34PM +0100, Ludovic Hirlimann wrote: > I'm trying to get as much possible people to a key party i'll organize > in 3 weeks. What are my best options , besides contacting local users > via biglumber, posting to upcoming.org and contacting the local LUG > (Area I'm targe

Re: Quieten gpg-agent output?

2012-01-11 Thread Aaron Toponce
On Wed, Jan 11, 2012 at 01:56:58PM +0100, Werner Koch wrote: > You should use the modern crypto implementaion of mutt. You merely need > to add > > set crypt_use_gpgme > > to ~/.muttrc. This uses a now also 10 years old mode of mutt which far > better integrates crypto than the old command base

Re: Quieten gpg-agent output?

2012-01-10 Thread Aaron Toponce
till see tho following: % gpg2 -qd file.gpg You need a passphrase to unlock the secret key for user: "Aaron Toponce " 1792-bit ELG key, ID E7D41E4B, created 2004-09-18 (main key ID 8086060F) The problem with Mutt, is the fact that when changing folders or accounts, it

Re: How to sign my own public key?

2011-12-29 Thread Aaron Toponce
On Thu, Dec 29, 2011 at 02:57:01PM +0300, Stayvoid wrote: > How to sign my own public key? > I've read that this is important. > Here is the link: http://www.heureka.clara.net/sunrise/pgpsign.htm Whenever you make changes to your key, it's automatically signed by you. -- . o . o . o . . o o

Re: maximum passphrase for symmetric encryption ?

2011-12-28 Thread Aaron Toponce
On Wed, Dec 28, 2011 at 12:32:44AM +0100, Jerome Baum wrote: > On 2011-12-28 00:27, Aaron Toponce wrote: > > On Tue, Dec 27, 2011 at 11:23:50PM +0100, Jerome Baum wrote: > >> I can't tell for gpg specifically but it's not so much about > >> "characters

Re: maximum passphrase for symmetric encryption ?

2011-12-27 Thread Aaron Toponce
There may be some errors in my reply, so if so, please notify me. On Tue, Dec 27, 2011 at 11:23:50PM +0100, Jerome Baum wrote: > On 2011-12-27 23:14, ved...@nym.hush.com wrote: > > The approximate equivalent in brute force work is 20 diceware > > words. > > [ 7776^19 < 2^256 < 7776^20 ]. > > > >

Re: Who is doing S/MIME enveloping in KMail - gnupg2 or KMail?

2011-12-21 Thread Aaron Toponce
On Wed, Dec 21, 2011 at 10:48:35AM -0500, Nicholas Sushkin wrote: > Hi, I think there is a bug in the way KMail is doing S/Mime envelop for signed > but not encrypted messages. I'd like to follow through, but I am not sure if > it's gnupg or KMail, which is the proper forum. Does anyone (Werner) kn

Re: GnuPG 2.1 beta 3 released

2011-12-21 Thread Aaron Toponce
On Tue, Dec 20, 2011 at 05:26:49PM +0100, Werner Koch wrote: > Noteworthy changes already found in beta2: > > * ECC support for GPG as described by draft-jivsov-openpgp-ecc-06.txt. Eager for this. Will we be seeing ECC support in 1.4.x? -- . o . o . o . . o o . . . o . . . o . o o o

Re: keyserver spam

2011-12-17 Thread Aaron Toponce
On Fri, Dec 16, 2011 at 03:51:34PM +, gn...@lists.grepular.com wrote: > I understand that once you've uploaded something to the keyservers, it > can't be removed. Eg, if I sign someone elses key and upload that, it > will be attached to their key permanently? > > What if someone were to generat

Re: small security glitches

2011-11-01 Thread Aaron Toponce
On Tue, Nov 01, 2011 at 02:04:31AM -0500, John A. Wallace wrote: > Hello. I was reading this page, > http://www.gnupg.org/faq/GnuPG-FAQ.html#cant-we-have-a-gpg-library , and I > found this comment near the end of it in the section entitled "How does this > whole thing work?": "There is a small se

Re: STEED - Usable end-to-end encryption

2011-10-17 Thread Aaron Toponce
On Mon, Oct 17, 2011 at 08:25:04PM +0200, Jerome Baum wrote: > How about an opportunistic approach? This email should include the > following header: > > OpenPGP: id=C58C753A; > url=https://jeromebaum.com/pgp > > The MUA could recognize a header like this one and remember that there's > a cer

Re: A better way to think about passwords

2011-04-27 Thread Aaron Toponce
On Sun, Apr 17, 2011 at 03:49:58PM -0700, Doug Barton wrote: > Summary: A 3-word password (e.g., "quick brown fox") is secure against > cracking attempts for 2,537 years. > > http://www.baekdal.com/tips/password-security-usability I'm just going to drop this here: http://www.troyhunt.com/2011/04/

Re: A better way to think about passwords

2011-04-27 Thread Aaron Toponce
On Tue, Apr 26, 2011 at 07:47:55PM -0300, Faramir wrote: > Indeed. In fact, I keep some passwords on paper, just in case I can't > use my password manager (like the password to access the site where I > stored the password manager database backup. It doesn't include the > passphrase to open the b

Re: Updating signature cert-level

2011-04-27 Thread Aaron Toponce
On Tue, Apr 26, 2011 at 01:12:00PM -0700, Doug Barton wrote: > I think you can delsig, then sign again. The keyservers would have > both, but hopefully client software (like gpg) would be smart enough > to use the more recent? I would imagine that revoking a signature > and then signing again would

Updating signature cert-level

2011-04-26 Thread Aaron Toponce
I signed a key, of which defaulted to cert-level 0 (I will not answer), which must be the default. When signing the key, GunPG didn't ask me about any checking. However, I would like to update the cert-level to 2 (I have done casual checking), but I'm unaware of how to do this. Do I need to revoke

Re: A better way to think about passwords

2011-04-24 Thread Aaron Toponce
On Sun, Apr 17, 2011 at 03:49:58PM -0700, Doug Barton wrote: > Summary: A 3-word password (e.g., "quick brown fox") is secure against > cracking attempts for 2,537 years. > > http://www.baekdal.com/tips/password-security-usability Yeah, I've read it. It sucks. If an author claims they know somethi

Re: Signing a key (meaning)

2011-04-07 Thread Aaron Toponce
On Thu, Apr 07, 2011 at 10:31:24AM +0200, takethe...@gmx.de wrote: > Definition: Signing a key means saying: "I confirm the full name in > the key's ID is the keyowner's right name. The email address in the ID > is the one the keyowner put there, but I cannot guarantee it's > his/hers. Yes you can

Re: Hi

2011-04-01 Thread Aaron Toponce
On Fri, Apr 01, 2011 at 08:15:44AM -0400, Jerry wrote: > I think you are misunderstanding what I am inferring. For starters, > that is the 5th account that I have heard or known of that was hacked > in March alone. I am sure that the total is far higher based on a simple > statistical accounting of

Re: Hi

2011-03-31 Thread Aaron Toponce
On Thu, Mar 31, 2011 at 07:25:20PM -0400, Jerry wrote: > On Thu, 31 Mar 2011 15:41:57 -0600 > Aaron Toponce articulated: > > http://passwordcard.org will fix that. :) > > Dumping GShit would have been my first choice. Not sure what your problem is. His account got hacked, li

Re: Hi

2011-03-31 Thread Aaron Toponce
On Thu, Mar 31, 2011 at 06:06:27PM +0100, Lee Elcocks wrote: >Im sorry, this email was not sent by me, ive been "hacked" should not >happen again (fingers crossed) http://passwordcard.org will fix that. :) -- . o . o . o . . o o . . . o . . . o . o o o . o . o o . . o o o

Re: GPG and PGP

2011-03-15 Thread Aaron Toponce
On Tue, Mar 15, 2011 at 04:14:25PM +0100, Johan Wevers wrote: > I don't know, but I do know that adding IDEA does not complicate or > bloat GnuPG. You're probably right. I guess I just don't understand supporting dead, deprecated, proprietary technology, bloat or no bloat. -- . o . o . o . .

Re: GPG and PGP

2011-03-15 Thread Aaron Toponce
On Tue, Mar 15, 2011 at 10:22:45AM +0100, Werner Koch wrote: > Yes. Back in 1997 I implemented PGP 2 compatible code as the first > towards GPG. Obviously I needed IDEA and RSA for testing. That is the > reason why we have this code at all. Later a lot of people demanded > that IDEA and RSA sho

Re: PGPFW658Win32

2011-03-14 Thread Aaron Toponce
On 03/14/2011 06:23 AM, Mike Acker wrote: > I don't like GPA and I don't like Cleopatra either. In the first place > you should need only 1 key-manager. Evidently GPA didn't cut it and so > they tried Cleopatra and missed with that too Who's "they"? The developers behind GPA are not the same dev

Re: RSA Versus DSA and EL GAMAL

2011-03-14 Thread Aaron Toponce
On 03/13/2011 09:21 PM, Jonathan Ely wrote: > I apologise in advance if this is a stupid question to ask now or if > people already asked it before I stepped on the scene, but which > algorithm is more secure: DSA and EL GAMAL or RSA? I know the latter has > undergone a ridiculous amount of scrutin

Re: For Windows

2011-03-13 Thread Aaron Toponce
On 03/13/2011 08:57 AM, Jerry wrote: > Outlook Express has been replaced by Windows Mail, an improved e‑mail > program with enhancements such as junk e‑mail filtering and protection > against phishing messages. > > Why are we even discussing a product that in not and has not been > available for q

Re: For Windows

2011-03-13 Thread Aaron Toponce
On 03/13/2011 06:56 AM, Brad Rogers wrote: > On Sun, 13 Mar 2011 06:05:12 -0600 > Aaron Toponce wrote: > > Hello Aaron, > >> On 03/13/2011 05:42 AM, Jerry wrote: >>> Actually, it is a fine example of users/MUAs not correctly formatting >>> e-mail messages

Re: For Windows

2011-03-13 Thread Aaron Toponce
On 03/13/2011 05:42 AM, Jerry wrote: > Actually, it is a fine example of users/MUAs not correctly formatting > e-mail messages thereby forcing the use of a deprecated method. [citation required] -- . o . o . o . . o o . . . o . . . o . o o o . o . o o . . o o o o . o . . o o

Re: For Windows

2011-03-11 Thread Aaron Toponce
On 03/11/2011 01:50 PM, Jonathan Ely wrote: > Hello. I use Enigmail, so of course I have GnuPG installed. I use 1.4.9 > because [1] I can not find an executable for 2.0.17 for Windows, and [2] > I do not know how to configure the GPG-agent. Can somebody please assist > me with upgrading to 2.0.17 a

Re: PGP/MIME considered harmful for mobile

2011-02-28 Thread Aaron Toponce
On Mon, Feb 28, 2011 at 11:58:02AM -0500, Robert J. Hansen wrote: > On 2/28/11 10:13 AM, Aaron Toponce wrote: > > If a key has falsified signatures, it should be easy enough to find out. > > Why? > > I have never understood the tendency of people, particularly on this &

Re: PGP/MIME considered harmful for mobile

2011-02-28 Thread Aaron Toponce
On Mon, Feb 28, 2011 at 09:12:33AM -0500, David Shaw wrote: > Unfortunately, barring the case where you have an actual trust path to either > Martin, key signatures don't tell you much. After all, FM could easily make > up dozens of fake people keys and use them to sign his key. Yes. Understood

Re: Security of the gpg private keyring?

2011-02-28 Thread Aaron Toponce
On 02/28/2011 04:47 AM, Guy Halford-Thompson wrote: > Assuming I have password protected secret keys, can I assume that the > gpg private keyring is secure? I.e., if my private keyring was to > fall into malicious hands, would the aforesaid hands be able to > extract any useful information from my

Re: PGP/MIME considered harmful for mobile

2011-02-28 Thread Aaron Toponce
On 02/27/2011 08:27 PM, Robert J. Hansen wrote: > FM: [message] > RM: Hey, that's not me! I'm me. See? I've signed this with the same cert > I've used for everything else on this list. > FM: No, I'm the real Martin. I didn't sign up for this mailing list until > last week. You signed up here

Re: Android PGP/MIME test results

2011-02-27 Thread Aaron Toponce
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Grant Olson wrote: >Provider: Boost >Manufacturer: Motorola >Model: I1 >Droid version: 1.5 > >This phone has two mail applications by default, one called 'email' and >another called 'gmail'. Both displayed PGP/MIME messages without any >trouble.

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Aaron Toponce
On 02/27/2011 12:37 PM, Martin Gollowitzer wrote: > I sign *all* my e-mail except for messages sent from my mobile (in that > case, my signature tells the receiver why the message is not signed and > offers the receiver to request a signed proof of authenticity later) or > messages to people who ca

Re: PGP/MIME considered harmful for mobile

2011-02-27 Thread Aaron Toponce
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 David Tomaschik wrote: >How about "inline confuses users who don't know anything about >OpenPGP"? Meh. If anything, inline signatures sparked conversation. - -- Sent from my Android phone with K-9 Mail. Please excuse my brevity. -BEGIN PGP SIG

Re: Default hash

2011-02-26 Thread Aaron Toponce
On 02/26/2011 04:37 PM, Faramir wrote: > Because its author says you should move to Twofish? Dammit! I meant Twofish, not Blowfish. I knew what I meant, but I didn't type it. -- . o . o . o . . o o . . . o . . . o . o o o . o . o o . . o o o o . o . . o o o o . o o o

Re: Default hash

2011-02-26 Thread Aaron Toponce
On 02/26/2011 02:27 PM, Faramir wrote: > Here he says Twofish has speed comparable with AES, without some > vulnerabilities (but Serpent is considered even more secure). However, > he says if AES fails, you won't be blamed for using it (so is the safest > for your career). If you chose Twofish, a

Re: Default hash

2011-02-26 Thread Aaron Toponce
On 02/26/2011 02:27 PM, Faramir wrote: > Here he says Twofish has speed comparable with AES, without some > vulnerabilities (but Serpent is considered even more secure). However, > he says if AES fails, you won't be blamed for using it (so is the safest > for your career). If you chose Twofish, a

Re: Default hash

2011-02-26 Thread Aaron Toponce
On 02/25/2011 08:46 PM, Robert J. Hansen wrote: > On 2/25/11 10:27 PM, Aaron Toponce wrote: >> On 02/25/2011 07:39 PM, Robert J. Hansen wrote: >>> Bruce himself recommends AES over TWOFISH. >> >> [citation needed] > > _Practical Cryptography_. Read it. Other

Re: Default hash

2011-02-25 Thread Aaron Toponce
On 02/25/2011 07:39 PM, Robert J. Hansen wrote: > Bruce himself recommends AES over TWOFISH. [citation needed] I know that he's recommended AES-128 over AES-256, but I've not read where he's recommended AES over TWOFISH. >> I don't trust 3DES > > Why? Bruce himself has said that if speed isn't

Re: PGP/MIME considered harmful for mobile

2011-02-25 Thread Aaron Toponce
On 02/24/2011 11:43 PM, Robert J. Hansen wrote: > My problem is reproducible on a stock Droid X running 2.2.something -- > just got off a very long flight, funeral in the morning: I'll dig the > precise version number tomorrow. So, I've been doing some triaging to see if I can reproduce this on ot

Re: Default hash

2011-02-25 Thread Aaron Toponce
On 02/25/2011 03:22 PM, Ben McGinnes wrote: > You shouldn't need to worry about changing the preferred order. GPG > will determine the most compatible combination of ciphers and hashes > based on the keys used to encrypt messages. For example, my preferred > symmetric cipher is AES-256, but on a

Re: PGP/MIME considered harmful for mobile

2011-02-24 Thread Aaron Toponce
On Thu, Feb 24, 2011 at 08:22:03PM -0500, Robert J. Hansen wrote: > On Android's mail application, PGP/MIME attachments are nigh-unusable. > It won't render even the plaintext portions: it has to be downloaded and > opened with a text reader. If you're concerned about your mail being > readable on

Re: Rebuilding the private key from signatures

2011-02-24 Thread Aaron Toponce
On Fri, Feb 25, 2011 at 03:39:10AM +1300, Atom Smasher wrote: > if an attacker has two messages signed with DSA, and they happen to > use the same value of "k" then it's trivial to recover the private > key. > > a random "k" is the achilles heel of DSA and elgamal (and their ECC > derivatives). if

Re: Default hash

2011-02-24 Thread Aaron Toponce
On Thu, Feb 24, 2011 at 08:37:50PM +1100, Ben McGinnes wrote: > Cipher: AES256, TWOFISH, CAMELLIA256, AES192, CAMELLIA192, AES, > CAMELLIA128, 3DES, CAST5, BLOWFISH, IDEA > Digest: SHA512, SHA384, SHA256, SHA224, RIPEMD160, SHA1, MD5 > Compression: BZIP2, ZLIB, ZIP, Uncompressed > Features: MDC, Ke

Re: Default hash

2011-02-24 Thread Aaron Toponce
On Thu, Feb 24, 2011 at 10:32:11AM -0500, Daniel Kahn Gillmor wrote: > On 02/24/2011 04:03 AM, Doug Barton wrote: > > You're using a 1024 bit DSA key, which won't allow for 256 bit hashes. > > RIPEMD-160 is the largest you can use, and works well for that kind of key. > > This isn't actually the c

Rebuilding the private key from signatures

2011-02-24 Thread Aaron Toponce
I generated my key back in 2004, and I've been a very vocal and active supporter of GnuPG, encrypting communications, and digitally signing mail. However, I was in a discussion with a friend, and the topic came up that it is theoretically possible to rebuild your private key if someone had access t

Re: Default hash

2011-02-24 Thread Aaron Toponce
On Thu, Feb 24, 2011 at 08:37:50PM +1100, Ben McGinnes wrote: > On 24/02/11 8:03 PM, Doug Barton wrote: > > You're using a 1024 bit DSA key, which won't allow for 256 bit > > hashes. RIPEMD-160 is the largest you can use, and works well for > > that kind of key. Okay. That's understandable. That

Default hash

2011-02-24 Thread Aaron Toponce
Given the release of v1.4.10, the SHA256 hashing algorithm is preferred over SHA1. Yet, after updating my default preferences with 'setpref' and signing some text, SHA1 is still used as the default hashing algorithm. Is there something else I need to do to ensure that I'm using SHA256 by default fo

Re: Mutt not showing signature flag

2010-12-23 Thread Aaron Toponce
On Thu, Dec 23, 2010 at 01:59:11PM +, Simon Ward wrote: > After a little investigation I believe signed mails that have had > signatures from mailing lists attached are not decoded until you view > the message. I’m guessing that Mutt only checks for Content-Type > multipart/signed, but these m

Mutt not showing signature flag

2010-12-22 Thread Aaron Toponce
This really is a post for the mutt-users mailing list, but I'm not getting the response there that I think is accurate, so I'm posting here, hoping mapbe another user on this list has experinced the same issue and what they did to fix it. As the subject says, the signature flag is not showing in t

Re: gpgkey2ssh

2010-10-21 Thread Aaron Toponce
On 10/21/2010 09:28 PM, Jameson Rollins wrote: > Hi, Aaron. You might be interested in some of the tools that come with > the Monkeysphere [0] package, which deals with a lot of OpenPGP for SSH > stuff. It comes with the utility openpgp2ssh, which translates OpenPGP > keys to SSH keys (and is wel

gpgkey2ssh

2010-10-21 Thread Aaron Toponce
First, there is _ZERO_ documentation for this binary. No manual, no info page, nothing under /usr/share/doc/, segfaults pasing "-h" or "--help". Short of digging through the source, this is unacceptable. Second, and probably as a result, I can't get this working for the life of me. Correct me if I