Re: Restarting gnupg-agent inside X session

2011-03-01 Thread Werner Koch
On Tue, 1 Mar 2011 02:41, da...@systemoverlord.com said: > Other than on systems where $HOME is on a filesystem that does not > support sockets (e.g., NFS/CIFS/etc.), is anyone aware of an issue with > the use of --use-standard-socket? Seems like it would make restarting GnuPG 2.1 will use --us

Re: Restarting gnupg-agent inside X session

2011-03-01 Thread Marco Steinacher
Daniel Kahn Gillmor wrote: > On 02/28/2011 06:49 PM, David Tomaschik wrote: >> Each process has its own copy of the environment inherited from its >> parent, so it's not possible to change the GPG_AGENT_INFO variable for >> all processes. You could start gpg-agent with --use-standard-socket, >> an

Re: GnuPG Card with ssh authentication problems

2011-03-01 Thread Werner Koch
On Sun, 27 Feb 2011 20:16, k...@grant-olson.net said: > If you want someone to cleanup and update the howto, I volunteer. I > just need to know the name of the cvs project. 'card-howto' didn't seem > to work. It is the module "card-howto" in the gpgweb repository. However, I recently started t

Re: Default hash

2011-03-01 Thread chr0n0
I believe that within the next five years someone will discover an academic attack against Rijndael. I do not believe that anyone will ever discover an attack that will allow someone to read Rijndael traffic. So while I have serious academic reservations about Rijndael, I do not have any engineeri

CA Certificate on GPF Cryptostick

2011-03-01 Thread Mario Lombardo
Hi, I´m trying to move a private Key (RSA, PEM format) made by a Microsoft CA to the GPF Crypto Stick. gpgsm tells me while importing: > pgsm: no issuer found in certificate > gpgsm: basic certificate checks failed - not imported > ERROR: object length field 1 octects too large > ERROR: object

Why do we use a different key to sign than to encrypt

2011-03-01 Thread Guy Halford-Thompson
Not GPG specific, but I was wondering if someone could point me in the direction of some resources that explain why we use different keys to sign and encrypt (for cases where the same key _could_ do both e.g. RSA). I cant seem to pick anything up on google. Thanks -- Guy Halford-Thompson - http

Re: PGP/MIME considered harmful for mobile

2011-03-01 Thread Johan Wevers
Op 28-2-2011 23:23, Robert J. Hansen schreef: > He then learned that his users thought the banner across the top was > "just another one of those annoying Flash ads," and they tuned it out. Their senses were dulled by overadvertising. He had better also distributed Adblock Plus to try to counter

Re: Smart Card Physical Best Practices?

2011-03-01 Thread Lists . gnupg
On Sat, Feb 26, 2011 at 09:40:07PM -0500 Also sprach David Tomaschik: I've recently received my smart card, but was wondering what the "best practices" are, mainly from a physical standpoint. When I use it in my laptop reader, it sticks about 2" out of the side, and I have some concern about th

[Announce] Libksba 1.2.0 released

2011-03-01 Thread Werner Koch
Hello! We are pleased to announce version 1.2.0 of Libksba. Libksba is an X.509 and CMS (PKCS#7) library. It is for example required to build the S/MIME part of GnuPG-2 (gpgsm). The only build requirement for Libksba itself is the libgpg-error package. There are no other dependencies; actual c

need help on non-interactive gnuPG binary

2011-03-01 Thread ravi shankar
Hi,    I am planning to use gnuPG (v1.4.10) binary in netbsd 5 for encryption. The key generation is supported as interactive session, but I want to use non interactive session. I could not find any binary with non interactive session. Does anyone know where to get such a binary?? Regards, Rav

Re: Why do we use a different key to sign than to encrypt

2011-03-01 Thread Guy Halford-Thompson
But doesnt GPG generate 2 private keys (as well as public keys) when you create a new keypair? Please select what kind of key you want: (1) RSA and RSA (default) (2) DSA and Elgamal (3) DSA (sign only) (4) RSA (sign only I can understand if you use DSA and Elgamal (DSA can only sign)

Re: Why do we use a different key to sign than to encrypt

2011-03-01 Thread David Shaw
On Mar 1, 2011, at 8:13 AM, Guy Halford-Thompson wrote: > Not GPG specific, but I was wondering if someone could point me in the > direction of some resources that explain why we use different keys to > sign and encrypt (for cases where the same key _could_ do both e.g. > RSA). I cant seem to pic

Re: Why do we use a different key to sign than to encrypt

2011-03-01 Thread Lists . gnupg
On Tue, Mar 01, 2011 at 01:13:16PM + Also sprach Guy Halford-Thompson: Not GPG specific, but I was wondering if someone could point me in the direction of some resources that explain why we use different keys to sign and encrypt (for cases where the same key _could_ do both e.g. RSA). Thi

Re: need help on non-interactive gnuPG binary

2011-03-01 Thread David Shaw
On Mar 1, 2011, at 7:39 AM, ravi shankar wrote: > Hi, > >I am planning to use gnuPG (v1.4.10) binary in netbsd 5 for encryption. > The key generation is supported as interactive session, but I want to use non > interactive session. I could not find any binary with non interactive > session

Re: Why do we use a different key to sign than to encrypt

2011-03-01 Thread Jeffrey Walton
On Tue, Mar 1, 2011 at 8:13 AM, Guy Halford-Thompson wrote: > Not GPG specific, but I was wondering if someone could point me in the > direction of some resources that explain why we use different keys to > sign and encrypt (for cases where the same key _could_ do both e.g. > RSA).  I cant seem to

Re: Why do we use a different key to sign than to encrypt

2011-03-01 Thread Guy Halford-Thompson
Thanks for the list of resources G On 1 March 2011 14:41, Jeffrey Walton wrote: > On Tue, Mar 1, 2011 at 8:13 AM, Guy Halford-Thompson wrote: >> Not GPG specific, but I was wondering if someone could point me in the >> direction of some resources that explain why we use different keys to >> sig

Re: Why do we use a different key to sign than to encrypt

2011-03-01 Thread David Tomaschik
On Tue, Mar 1, 2011 at 9:34 AM, wrote: > On Tue, Mar 01, 2011 at 01:13:16PM + Also sprach Guy Halford-Thompson: >> >> Not GPG specific, but I was wondering if someone could point me in the >> direction of some resources that explain why we use different keys to >> sign and encrypt (for cases

Re: Why do we use a different key to sign than to encrypt

2011-03-01 Thread Jameson Rollins
On Tue, 1 Mar 2011 14:30:37 +, Guy Halford-Thompson wrote: > But doesnt GPG generate 2 private keys (as well as public keys) when > you create a new keypair? > > Please select what kind of key you want: >(1) RSA and RSA (default) >(2) DSA and Elgamal >(3) DSA (sign only) >(4)

Re: Security of the gpg private keyring?

2011-03-01 Thread Ingo Klöcker
On Tuesday 01 March 2011, David Shaw wrote: > On Feb 28, 2011, at 7:09 PM, David Tomaschik wrote: > >> I think key UIDs generally reveal more information than I am > >> comfortable with. For example, why does your UID need to contain > >> your email address in plain text rather than as a hash? Sear

Re: PGP/MIME considered harmful for mobile

2011-03-01 Thread Ingo Klöcker
On Sunday 27 February 2011, Doug Barton wrote: > On 02/27/2011 02:04, Ingo Klöcker wrote: > > On Saturday, February 26, 2011, MFPA wrote: > >> Hi > >> > >> > >> On Friday 25 February 2011 at 1:45:03 AM, in > >> > >> , Jameson Rollins wrote: > >>> Yikes! I thought we were almost done killing in

key generation problems

2011-03-01 Thread George
Hi, I have CentOS 5.5 with gnupg 1.4.5. I am using the following command to generate the keys: echo LinuxMasters | /usr/bin/gpg --homedir /home/USER/.gnupg -e -a -r em...@domain.com > /somefile The problem I am facing is that until today all the keys generated using this command had the same siz

Re: Security of the gpg private keyring?

2011-03-01 Thread MFPA
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi On Tuesday 1 March 2011 at 8:56:56 PM, in , Ingo Klöcker wrote: > Hmm. Why do the keyservers need to support it at all? > IMO the clients that want to upload a key should check > for this flag and warn the user if a key has this flag. I thin

Re: Security of the gpg private keyring?

2011-03-01 Thread David Shaw
On Mar 1, 2011, at 6:29 PM, MFPA wrote: > On Tuesday 1 March 2011 at 8:56:56 PM, in > , Ingo Klöcker wrote: > > >> Hmm. Why do the keyservers need to support it at all? >> IMO the clients that want to upload a key should check >> for this flag and warn the user if a key has this flag. > > I th

Re: hashed user IDs [was: Re: Security of the gpg private keyring?]

2011-03-01 Thread MFPA
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi On Tuesday 1 March 2011 at 1:54:25 AM, in , Daniel Kahn Gillmor wrote: > However, i'm quite serious about the flaws paralleling > the failures of NSEC3 to prevent DNS zone enumeration. > the problem space is slightly different, but i think > t

Re: hashed user IDs [was: Re: Security of the gpg private keyring?]

2011-03-01 Thread Daniel Kahn Gillmor
On 03/01/2011 08:05 PM, MFPA wrote: > My analogy, admittedly not a direct comparison, would be having a > phone number that is ex-directory. It is no defence against random > dialling, nor against your number being recorded from outgoing calls > if you don't take steps such as withholding the CLI,

Re: hashed user IDs [was: Re: Security of the gpg private keyring?]

2011-03-01 Thread MFPA
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi On Wednesday 2 March 2011 at 1:43:45 AM, in , Daniel Kahn Gillmor wrote: > On 03/01/2011 08:05 PM, MFPA wrote: >> My analogy, admittedly not a direct comparison, would be having a >> phone number that is ex-directory. It is no defence against

Re: hashed user IDs [was: Re: Security of the gpg private keyring?]

2011-03-01 Thread Robert J. Hansen
> The benefits of your phone number being ex-directory are the benefits > that derive from it being harder for people to obtain your phone > number without your permission, harder to link the number to your > name/address, and impossible to find your address or phone number by > looking in the phon