Re: Ohhhh jeeee: can't encode a 512 bit MD into a 608 bits frame

2015-05-27 Thread NIIBE Yutaka
On 05/22/2015 02:27 AM, Philip Jackson wrote: > The key ID was 0x6e767393 It seems for me that this key has subkey of ECC, and that's the cause of your trouble. I think that we need to implement some compatibility feature in GnuPG 2.0 (and 1.4). Last month, I did a fix, but I think that more is

Re: installing version 2.1.4 in Debian 8.0 (Jessie)

2015-05-27 Thread Peter Lebbing
On 27/05/15 06:22, Rex Kneisley wrote: > As a follow up. Since, version 1.4 is also installed, my assumption > is that using "gpg" on the command line invokes 1.4, and using "gpg2" > on the command line invokes 2.x. Is my assumption correct? Yes. > If so, is there any way to make the command "gpg

Re: Ohhhh jeeee: can't encode a 512 bit MD into a 608 bits frame

2015-05-27 Thread Philip Jackson
On 27/05/15 10:36, NIIBE Yutaka wrote: > On 05/22/2015 02:27 AM, Philip Jackson wrote: >> The key ID was 0x6e767393 > > It seems for me that this key has subkey of ECC, and that's the cause > of your trouble. You're right - this key has an ECC subkey for signing. I've imported this key into anot

Re: Ohhhh jeeee: can't encode a 512 bit MD into a 608 bits frame

2015-05-27 Thread NIIBE Yutaka
Hello, Thank you for more information. On 05/27/2015 08:53 PM, Philip Jackson wrote: > I tried to re-import it into the original desktop system to see if the problem > recurred. (I should have done that before writing the last mail, to confirm > fault). With the original desktop : gpg 1.4.16 and

Re: Ohhhh jeeee: can't encode a 512 bit MD into a 608 bits frame

2015-05-27 Thread Philip Jackson
On 27/05/15 15:05, NIIBE Yutaka wrote: > It was done soon after 2.0.22. I think that 2.0.23 or later doesn't > have this issue. The signature check is just skipped as unknown algo. One of the problems with using linux distribution packages. The latest for Ubuntu 1404 is 2.0.22-3ubuntu1.3 which

Re: Random Seed for Generating PGP Keys

2015-05-27 Thread George Lee
Hi, > I know that a CSPRNG is supposed to make this cryptographically secure Also, I may be wrong here -- it seems that CSPRNG sometimes refers to libgcrypt's "Continuously Seeded" and other times refers to "Cryptographically Secure." Peace, community, justice, - George _

Re: Random Seed for Generating PGP Keys

2015-05-27 Thread George Lee
Hi, I'm not trying to generate multiple random numbers, but just generate a PGP key one time in a way that is very hard to crack by basing it on a one-time seed generated manually in a reliably random way. With software, there's risks that the sequence of numbers generated isn't fully random and

Re: Random Seed for Generating PGP Keys

2015-05-27 Thread Robert J. Hansen
> number it generates. I know that a CSPRNG is supposed to make this > cryptographically secure, but (and correct me if I'm wrong) it seems > that some one-time offline truly random process (like rolling a > thousand non-biased coins by a no-biased person) is guaranteed to be > more random than a

Re: Random Seed for Generating PGP Keys

2015-05-27 Thread Robert J. Hansen
> Also, I may be wrong here -- it seems that CSPRNG sometimes refers > to libgcrypt's "Continuously Seeded" and other times refers to > "Cryptographically Secure." It's an unfortunate ambiguity, yes. "Cryptographically secure" is a misnomer at best: it tends to lead people into thinking it means

Re: Ohhhh jeeee: can't encode a 512 bit MD into a 608 bits frame

2015-05-27 Thread Werner Koch
On Wed, 27 May 2015 15:24, philip.jack...@nordnet.fr said: > One of the problems with using linux distribution packages. The latest for > Ubuntu 1404 is 2.0.22-3ubuntu1.3 which I have. Ubuntu 1404 is the current > LongTermSupport version. I would expect that a LTS version fixes critical bugs.

Re: Random Seed for Generating PGP Keys

2015-05-27 Thread flapflap
George Lee: > I'm not trying to generate multiple random numbers, but just generate a PGP > key one time in a way that is very hard to crack by basing it on a one-time > seed generated manually in a reliably random way. I might be wrong here, but as I understand it you need way more often random n

https://www.gnupg.org/download/index.en.html#dirmngr contains a typo : "Dirmngr >is< an optional tool>s<"

2015-05-27 Thread Toralf Förster
;) -- Toralf pgp key: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 0076 E94E ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Random Seed for Generating PGP Keys

2015-05-27 Thread Daniel Kahn Gillmor
On Tue 2015-05-26 23:08:56 -0400, NIIBE Yutaka wrote: > Lessen was: Wikipedia is(was) not friendly to DIY hardware/software > people to link there useful information. Wikipedia sees itself as not a place to publish original research, and they frown on self-linking to avoid . However, i think NeuG

Re: Random Seed for Generating PGP Keys

2015-05-27 Thread NIIBE Yutaka
Hello, On 05/27/2015 10:14 PM, George Lee wrote: > I'm not trying to generate multiple random numbers, but just generate a PGP > key one time in a way that is very hard to crack by basing it on a one-time > seed generated manually in a reliably random way. I'd understand your point. I interpret

Re: Trying to install version 2.1.4

2015-05-27 Thread Daniel Kahn Gillmor
On Sun 2015-05-24 06:58:21 -0400, Peter Lebbing wrote: > It might also be that the package maintainers (hi dkg!) might soon put 2.1.4 > into experimental themselves. So it really depends on how far you want to take > this "I need the latest and greatest". Sorry, i'm aware of this but terribly behi

Re: Trying to install version 2.1.4

2015-05-27 Thread Daniel Kahn Gillmor
On Wed 2015-05-27 22:40:44 -0400, Daniel Kahn Gillmor wrote: > On Sun 2015-05-24 06:58:21 -0400, Peter Lebbing wrote: >> It might also be that the package maintainers (hi dkg!) might soon put 2.1.4 >> into experimental themselves. So it really depends on how far you want to >> take >> this "I need

Re: Trying to install version 2.1.4

2015-05-27 Thread Rex Kneisley
Successfully installed Gpg2 experimental. I was pleasantly surprised to find that I was at 2.1.4 when I ran a version check from the command line. Also installed GPA. Imported my private key successfully. Can still see all the public keys I Imported using 2.0.26. Seems to be running fine so far.