Re: gpgsm data structure

2009-05-04 Thread Werner Koch
On Thu, 30 Apr 2009 14:02, rooki...@arcor.de said: > A recipient cannot decrypt my gpgsm signed and encrypted data. He sent me > some data he can decrypt. It looks like this: If you post ASN.1 dumps and expect me to read them, pretty please use dumpasn1 and not the openssl tools. > So here.s my

Re: New results against SHA-1

2009-05-04 Thread Werner Koch
On Fri, 1 May 2009 05:58, a...@smasher.org said: > so... when is the open-pgp spec moving beyond SHA1 hashes to identify > public keys? what's next? will it have to be a bigger hash? OpenPGP does not claim that the fingerprint is a unique way to identify a key. Also note that the results are a

Re: gnupg 1.2.6

2009-05-04 Thread Werner Koch
On Sat, 2 May 2009 09:06, webmas...@felipe1982.com said: > My web host has gnupg 1.2.6 on their machines. I often SSH into it when > I am not at home on my gnulinux box. Anything I should be concerned > about when using this version? the two key pairs I made (DSS signing, > ELG encryption) wer

Re: New results against SHA-1

2009-05-04 Thread Nicholas Cole
On Mon, May 4, 2009 at 9:24 AM, Werner Koch wrote: > On Fri,  1 May 2009 05:58, a...@smasher.org said: > >> so... when is the open-pgp spec moving beyond SHA1 hashes to identify >> public keys? what's next? will it have to be a bigger hash? > > OpenPGP does not claim that the fingerprint is a uniq

Re: New results against SHA-1

2009-05-04 Thread Werner Koch
On Mon, 4 May 2009 12:16, nicholas.c...@gmail.com said: > How does GPG cope if two keys on the keyring have the same FP? AFAICS > that would make things very difficult for most of the front-ends, I don't know, because I am not able to create such keys ;-). It is not different from looking up t

Re: New results against SHA-1

2009-05-04 Thread David Shaw
On May 4, 2009, at 6:16 AM, Nicholas Cole wrote: On Mon, May 4, 2009 at 9:24 AM, Werner Koch wrote: On Fri, 1 May 2009 05:58, a...@smasher.org said: so... when is the open-pgp spec moving beyond SHA1 hashes to identify public keys? what's next? will it have to be a bigger hash? OpenPGP

Re: Use other hash than SHA-1

2009-05-04 Thread Raimar Sandner
On Monday 04 May 2009 04:56:24 David Shaw wrote: > If you want a DSA2 key: > >gpg --enable-dsa2 --gen-key > > Select option 1, and enter 3072 for the DSA key size. > If you want an RSA key: > > gpg --cert-digest-algo sha256 --gen-key > > Select option 5. Enter a RSA key size. The defau

Re: Use other hash than SHA-1

2009-05-04 Thread Simon Ruderich
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On Sun, May 03, 2009 at 10:56:24PM -0400, David Shaw wrote: > [snip] > > The end result will be a key that does not use SHA-1 either in its > internal construction or in signatures it makes elsewhere. Keep in mind > that there are some clients out t

Re: New results against SHA-1

2009-05-04 Thread Christoph Anton Mitterer
On Mon, 2009-05-04 at 13:39 +0200, Werner Koch wrote: > The only real crypto use in the protocol is with the revocation key > (designated revoker) which uses a 20 byte fingerprint to specify the > key. However I cannot see where there is a threat. Ok,.. but most people do not exchange they key-dat

Re: Use other hash than SHA-1

2009-05-04 Thread Faramir
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Raimar Sandner escribió: > On Monday 04 May 2009 04:56:24 David Shaw wrote: > >> If you want a DSA2 key: >> >>gpg --enable-dsa2 --gen-key >> >> Select option 1, and enter 3072 for the DSA key size. > > >> If you want an RSA key: >> >> gpg

Re: Use other hash than SHA-1

2009-05-04 Thread Christoph Anton Mitterer
On Sun, 2009-05-03 at 22:56 -0400, David Shaw wrote: > It's important to remember that this isn't a completely SHA-1 free > key, as that is not currently possible in the OpenPGP protocol, but it > is possible to make a "use as little SHA-1 as possible key". Is there anything else than the finge

Re: New results against SHA-1

2009-05-04 Thread Christoph Anton Mitterer
On Mon, 2009-05-04 at 13:39 +0200, Werner Koch wrote: > The forthcoming new keyring > format will cope with that by not allowing a second key with the same > fingerprint. Ah,.. I've always thought this would be already the case ^^ When will we see this new format? Chris. smime.p7s Description

Re: New results against SHA-1

2009-05-04 Thread John W. Moore III
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Nicholas Cole wrote: > How does GPG cope if two keys on the keyring have the same FP? AFAICS > that would make things very difficult for most of the front-ends, > especially if they had been relying on the uniqueness (in practice) of > the FP to sp

Re: How easy would it be to create (and prevent the creation of) a fake pinentry?

2009-05-04 Thread Olivier Mehani
On Wed, Apr 29, 2009 at 04:40:47PM +0300, Peter Pentchev wrote: > > The pinentry should only pop up when the application actually needs the key > > do > > do something. If pinentry pops up without you doing someting that requires > > your secret key, you should be worried. > ...like, for example

How to use salt in the gpg decrypt expression?

2009-05-04 Thread MShah
I have gpg encrypted data that I imported into the DB at my company, they have provided the passphrase and salt. I am wondering how to provide the salt in the decrypting expression. Any feedback on this will be appreciated. Here is how I am using it without the salt: gpg.exe --passphrase Id6Ai

Re: New results against SHA-1

2009-05-04 Thread Nicholas Cole
On Mon, May 4, 2009 at 10:01 PM, John W. Moore III wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA512 > > Nicholas Cole wrote: > >> How does GPG cope if two keys on the keyring have the same FP?  AFAICS >> that would make things very difficult for most of the front-ends, >> especially if t

Re: Use other hash than SHA-1

2009-05-04 Thread David Shaw
On May 4, 2009, at 11:21 AM, Raimar Sandner wrote: On Monday 04 May 2009 04:56:24 David Shaw wrote: If you want a DSA2 key: gpg --enable-dsa2 --gen-key Select option 1, and enter 3072 for the DSA key size. If you want an RSA key: gpg --cert-digest-algo sha256 --gen-key Select option

Re: Use other hash than SHA-1

2009-05-04 Thread David Shaw
On May 4, 2009, at 1:40 PM, Christoph Anton Mitterer wrote: On Sun, 2009-05-03 at 22:56 -0400, David Shaw wrote: It's important to remember that this isn't a completely SHA-1 free key, as that is not currently possible in the OpenPGP protocol, but it is possible to make a "use as little SHA-