Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > alt.os.linux > #39203 > unrolled thread

Marek Novotny GnuPG

Back to article view | Back to alt.os.linux

Contents

  Marek Novotny GnuPG Marek Novotny <marek.novotny@marspolar.com> - 2016-09-26 00:00 +0000
    Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-25 17:32 -0700
      Re: Marek Novotny GnuPG Marek Novotny <marek.novotny@marspolar.com> - 2016-09-26 01:04 +0000
      Re: Marek Novotny GnuPG The Letter Q <babbaquimby@teachers.org> - 2016-09-26 11:12 -0400
    Re: Marek Novotny GnuPG "Carlos E.R." <robin_listas@invalid.es> - 2016-09-26 03:56 +0200
    Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 10:53 +0000
      Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 05:10 -0700
        Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 05:22 -0700
          Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 05:45 -0700
            Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 10:10 -0700
              Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 10:54 -0700
            Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-27 11:27 -0700
              Re: Marek Novotny GnuPG Marek Novotny <marek.novotny@marspolar.com> - 2016-09-27 18:40 +0000
              Re: Marek Novotny GnuPG Bit Twister <BitTwister@mouse-potato.com> - 2016-09-27 18:41 +0000
                Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-27 12:06 -0700
                Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-28 10:14 -0700
                  Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-28 10:38 -0700
              Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-27 11:44 -0700
                Re: Marek Novotny GnuPG Melzzzzz <Melzzzzz@zzzzz.com> - 2016-09-27 19:00 +0000
                  Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-27 12:20 -0700
                    Re: Marek Novotny GnuPG "Carlos E.R." <robin_listas@invalid.es> - 2016-09-28 00:04 +0200
                      Re: Marek Novotny GnuPG Richard Kettlewell <invalid@invalid.invalid> - 2016-09-27 23:21 +0100
                        Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-27 15:35 -0700
                        Re: Marek Novotny GnuPG "Carlos E.R." <robin_listas@invalid.es> - 2016-09-28 00:44 +0200
                          Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-27 15:58 -0700
              Re: Marek Novotny GnuPG "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2016-09-27 19:24 -0400
                Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-28 01:06 -0700
                  Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-28 10:38 +0000
                  Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-28 11:21 -0700
              Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-28 10:31 +0000
                Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-28 11:24 +0000
                  Re: Marek Novotny GnuPG "Carlos E.R." <robin_listas@invalid.es> - 2016-09-28 16:08 +0200
                    Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-28 19:55 +0000
                      Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-28 13:11 -0700
                        Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-28 22:04 +0000
                          Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-28 16:11 -0700
          Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 13:27 +0000
            Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 06:59 -0700
        Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 13:25 +0000
      Re: Marek Novotny GnuPG "Carlos E.R." <robin_listas@invalid.es> - 2016-09-26 15:26 +0200
        Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 13:33 +0000
          Re: Marek Novotny GnuPG "Carlos E.R." <robin_listas@invalid.es> - 2016-09-26 15:40 +0200
            Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 13:48 +0000
        Re: Marek Novotny GnuPG Richard Kettlewell <invalid@invalid.invalid> - 2016-09-26 14:39 +0100
          Re: Marek Novotny GnuPG Snit <usenet@gallopinginsanity.com> - 2016-09-26 07:00 -0700
            Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 07:26 -0700
              Re: Marek Novotny GnuPG Marek Novotny <marek.novotny@marspolar.com> - 2016-09-26 14:53 +0000
              Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 14:59 +0000
                Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 15:01 +0000
              Re: Marek Novotny GnuPG Snit <usenet@gallopinginsanity.com> - 2016-09-26 07:34 -0700
                Re: Marek Novotny GnuPG Peter Köhlmann <peter-koehlmann@t-online.de> - 2016-09-26 18:24 +0200
                  Re: Marek Novotny GnuPG Snit <usenet@gallopinginsanity.com> - 2016-09-26 09:30 -0700
          Re: Marek Novotny GnuPG "Carlos E.R." <robin_listas@invalid.es> - 2016-09-26 16:31 +0200
            Re: Marek Novotny GnuPG Richard Kettlewell <invalid@invalid.invalid> - 2016-09-26 15:59 +0100
              Re: Marek Novotny GnuPG "Carlos E.R." <robin_listas@invalid.es> - 2016-09-26 19:45 +0200
                Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 14:29 -0700
                  Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 14:37 -0700
                    Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 15:17 -0700
                      Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 23:27 +0000
          Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 15:00 -0700
            Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-26 15:34 -0700
              Re: Marek Novotny GnuPG "Carlos E.R." <robin_listas@invalid.es> - 2016-09-27 15:58 +0200
                Re: Marek Novotny GnuPG Mike Easter <MikeE@ster.invalid> - 2016-09-27 07:11 -0700
      Re: Marek Novotny GnuPG Marek Novotny <marek.novotny@marspolar.com> - 2016-09-26 14:14 +0000
        Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 14:57 +0000
          Re: Marek Novotny GnuPG Marek Novotny <marek.novotny@marspolar.com> - 2016-09-26 15:09 +0000
            Re: Marek Novotny GnuPG Marek Novotny <marek.novotny@marspolar.com> - 2016-09-26 15:14 +0000
            Re: Marek Novotny GnuPG Dan Purgert <dan@djph.net> - 2016-09-26 15:18 +0000

Page 2 of 4 — ← Prev page 1 [2] 3 4  Next page →

#39296

On 2016-09-27 21:20, Mike Easter wrote:
> Melzzzzz wrote:
>> Mike Easter wrote:
> 
>>> The article suggests:
>>>
>>> sudo rngd -r /dev/urandom
>>>
>> What's wrong with /dev/random ?
>>
> If you are asking me why the article recommended urandom instead of
> random, I don't know the answer (yet) and he didn't say.

If there is not enough entropy "/dev/random" waits till there is. On the
other hand, "/dev/urandom" doesn't wait. The man page says: «As a
result, if there is not sufficient entropy in the entropy pool, the
returned values are theoretically vulnerable to a cryptographic attack
on the algorithms used by the driver.  Knowledge of how to do this is
not  available in  the  current  unclassified  literature,  but it is
theoretically possible that such an attack may exist.  If this is a
concern in your application, use "/dev/random" instead.»

So, for practical purposes, urandom is preferred. For applications where
you must be absolutely sure of the true randomness of the data, then use
"random".

The man page says «If  you  are  unsure  about  whether you should use
/dev/random or /dev/urandom, then probably you want to use the latter.
As a general rule, /dev/urandom should be used for everything except
long-lived GPG/SSL/SSH keys.»

-- 
Cheers, Carlos.

[toc] | [prev] | [next] | [standalone]

#39297

"Carlos E.R." <robin_listas@invalid.es> writes:
> On 2016-09-27 21:20, Mike Easter wrote:
>> Melzzzzz wrote:
>>> Mike Easter wrote:
>>>> The article suggests:
>>>>
>>>> sudo rngd -r /dev/urandom
>>>>
>>> What's wrong with /dev/random ?
>>>
>> If you are asking me why the article recommended urandom instead of
>> random, I don't know the answer (yet) and he didn't say.
>
> If there is not enough entropy "/dev/random" waits till there is. On the
> other hand, "/dev/urandom" doesn't wait. The man page says: [...]

You should read the link Mike posted more carefuly.

-- 
http://www.greenend.org.uk/rjk/

[toc] | [prev] | [next] | [standalone]

#39298

Richard Kettlewell wrote:
> "Carlos E.R."

>> If there is not enough entropy "/dev/random" waits till there is. On the
>> other hand, "/dev/urandom" doesn't wait. The man page says: [...]
>
> You should read the link Mike posted more carefuly.

That is a pretty 'hairy' article about parsing the man pages words.

The wp article on random/urandom also cites and parses the man words, 
but not to such an extent as the article.

The man page for urandom is much more 'expository' than the one for random.




-- 
Mike Easter

[toc] | [prev] | [next] | [standalone]

#39299

On 2016-09-28 00:21, Richard Kettlewell wrote:
> "Carlos E.R." <robin_listas@invalid.es> writes:
>> On 2016-09-27 21:20, Mike Easter wrote:
>>> Melzzzzz wrote:
>>>> Mike Easter wrote:
>>>>> The article suggests:
>>>>>
>>>>> sudo rngd -r /dev/urandom
>>>>>
>>>> What's wrong with /dev/random ?
>>>>
>>> If you are asking me why the article recommended urandom instead of
>>> random, I don't know the answer (yet) and he didn't say.
>>
>> If there is not enough entropy "/dev/random" waits till there is. On the
>> other hand, "/dev/urandom" doesn't wait. The man page says: [...]
> 
> You should read the link Mike posted more carefuly.

I don't see a contradiction.


-- 
Cheers, Carlos.

[toc] | [prev] | [next] | [standalone]

#39300

Carlos E.R. wrote:
> Richard Kettlewell wrote:
>> "Carlos E.R." writes:
>>>  Mike Easter wrote:
>>>> Melzzzzz wrote:
>>>>> Mike Easter wrote:
>>>>>> The article suggests:
>>>>>>
>>>>>> sudo rngd -r /dev/urandom
>>>>>>
>>>>> What's wrong with /dev/random ?
>>>>>
>>>> If you are asking me why the article recommended urandom
>>>> instead of random, I don't know the answer (yet) and he didn't
>>>> say.
>>>
>>> If there is not enough entropy "/dev/random" waits till there
>>> is. On the other hand, "/dev/urandom" doesn't wait. The man page
>>> says: [...]
>>
>> You should read the link Mike posted more carefuly.
>
> I don't see a contradiction.
>
  o what you cited is indeed what it/man says
  o what is controversial is how to interpret what it says
  o I don't really think 'what's wrong with dev/random?' is 'wrong'
  o I ALSO don't really think that the article's strong affirmative 
statement in its 'myth busting' should be quite as affirmative as presented

// Fact: /dev/urandom is the preferred source of cryptographic 
randomness on UNIX-like systems. //

... because the article also later says:

// The man page does recommend the use of /dev/random in some cases (it 
doesn't hurt, in my opinion, but is not strictly necessary), //

Soooo, now he says, it (random) doesn't hurt but isn't strictly 
necessary.  Quite different from the emphatic urandom preferred 
insistence statement in the opening par.


-- 
Mike Easter

[toc] | [prev] | [next] | [standalone]

#39301

On Tue, 27 Sep 2016 14:27:34 -0400, Mike Easter <MikeE@ster.invalid> wrote:

> I'm surprised at the time required by my system (the one I'm working
> with for this is not my slowest) to generate a keypair.

It's reading data from /dev/random. When /dev/random is empty, the
read goes into a wait, until there is more random data available.

To speed up the key generation, run some other program, and type in a
document, or keep moving and clicking the mouse. The timing of the
keystrokes, mouse movements and clicks, will help to feed more data
into /dev/random.

cat /proc/sys/kernel/random/entropy_avail will show how many bits
(might be bytes, not sure) of random data are currently available.

Regards, Dave Hodgins

-- 
Change dwhodgins@nomail.afraid.org to davidwhodgins@teksavvy.com for
email replies.

[toc] | [prev] | [next] | [standalone]

#39303

David W. Hodgins wrote:
> To speed up the key generation, run some other program, and type in
> a document, or keep moving and clicking the mouse. The timing of the
> keystrokes, mouse movements and clicks, will help to feed more data
> into /dev/random.
>
> cat /proc/sys/kernel/random/entropy_avail will show how many bits
> (might be bytes, not sure) of random data are currently available.

My work at that time was being done on a live boot with added enigmail 
and other tools and the advised mouse/kb activity wasn't getting it 
done.  The next time I start there in the same way, I'll research the 
entropy before I start to make a key pair.

If someone wants to make an improvement, the system or gpg should throw 
up an 'insufficient entropy' alert rather than just 'hanging' or telling 
the user that it might take a while so be patient.  A while might be 
hours or unlimited in a hung state.

-- 
Mike Easter

[toc] | [prev] | [next] | [standalone]

#39306

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Mike Easter wrote:
> David W. Hodgins wrote:
>> To speed up the key generation, run some other program, and type in
>> a document, or keep moving and clicking the mouse. The timing of the
>> keystrokes, mouse movements and clicks, will help to feed more data
>> into /dev/random.
>>
>> cat /proc/sys/kernel/random/entropy_avail will show how many bits
>> (might be bytes, not sure) of random data are currently available.
>
> My work at that time was being done on a live boot with added enigmail 
> and other tools and the advised mouse/kb activity wasn't getting it 
> done.  The next time I start there in the same way, I'll research the 
> entropy before I start to make a key pair.
>
> If someone wants to make an improvement, the system or gpg should throw 
> up an 'insufficient entropy' alert rather than just 'hanging' or telling 
> the user that it might take a while so be patient.  A while might be 
> hours or unlimited in a hung state.
>

/dev/random doesn't hang (usually...), though I understand and agree
with where you're coming from.  

For gnupg2, version 2.0.26 on Devuan* (note, I moved the binaries and made a
symlink between /usr/bin/gpg and /usr/bin/gpg2, because I always forget
to call 'gpg2' outright), this is what it says:

| We need to generate a lot of random bytes. It is a good idea to perform
| some other action (type on the keyboard, move the mouse, utilize the
| disks) during the prime generation; this gives the random number
| generator a better chance to gain enough entropy.



* Devuan Jessie = systemd-free fork of Debian Jessie.  Support init
  freedom :)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJX651QAAoJEI4R3fMSeaKBWdgH/2gCAub3aOXbjQ76MzjL0Wwq
iEebin1GsKJLWvOHC2h+8bqL+sEuV81CWKiurwrkgQ3wouGuwfzZmpPw/w8heAVB
4+MEYcOrROVIDfolDirqi4gwRHxysv677t60o5fREc0mHdpHKRoeu0wbPQhof24x
Uyh2jM2VCHneOImBm1NV+AwNB9QmVYrHdu9njzqiRMKN1RfEFwp+j0KsGb11ID1r
lkiCSiLy3stf7tGu8kW55Bnfpz337nNLu8XgqNWzjQd/B0WvpIOwB4hYdeepGDpE
fxMcDFhd5dyk6Cq9vro0d9A5P0JALz4wiXwrbe+UUz2XGuqGb01rBirMp8zJvcI=
=pqof
-----END PGP SIGNATURE-----

-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#39323

Mike Easter wrote:
> David W. Hodgins wrote:

>> cat /proc/sys/kernel/random/entropy_avail will show how many bits
>> (might be bytes, not sure) of random data are currently available.
>
> The next time I start there in the same way, I'll research the
> entropy before I start to make a key pair.
>
Altho' I haven't personally researched the entropy, the author of the 
cited anti-hang article has //this// to say about the rngd strategy:

// Watching cat /proc/sys/kernel/random/entropy_avail seems to confirm 
this theory. Without rngd running (execute sudo killall rngd to kill the 
rngd process), the entropy would start high and then stay in the single 
to double digits and never replenish. This causes GPG to apparently 
hang. Starting rngd again (in a separate terminal while GPG is still 
running) causes the entropy to replenish and GPG completes the key 
generation. //


-- 
Mike Easter

[toc] | [prev] | [next] | [standalone]

#39305

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Mike Easter wrote:
> "Your key is being generated.  Even on fast computers this may take a 
> while.  Please be patient."
>
> The next time I do it, I'm going to set a clock (or a calendar :-)

Assuming 'time' works right... 

Generating a 4096-bit key, on my laptop with the following system specs
/ utilization  (AFTER running 'time gpg --gen-key' and answering the
prompts, because I didn't think beforehand)

Intel(R) Core(TM) i7-2670QM CPU @ 2.20GHz <-- quad-core processor +
hyper-threading.

top - 06:27:08 up 45 days, 11:35,  7 users,  load average: 1.40, 1.55,
1.52
Tasks: 274 total,   2 running, 272 sleeping,   0 stopped,   0 zombie
%Cpu(s):  6.5 us,  8.5 sy,  0.0 ni, 84.5 id,  0.3 wa,  0.0 hi,  0.1 si,
%0.0 st
KiB Mem:   8088796 total,  7297908 used,   790888 free,   312572 buffers
KiB Swap: 16556028 total,    98648 used, 16457380 free.  4908580 cached
Mem

NOTE --> I am connected to it via ssh, and running screen, so that's
probably where the users come from.

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJX65uOAAoJEI4R3fMSeaKBdmoH/3pokTlRnDs3oqD6jaGJRsWy
W73U2OypPuu9Ory+p/ddgO0hommhdzlwG+ptu4D1kBwOjhyUvxJmmaoR2CEDMlwq
JGUrj2PW09yv4oJshHJ/cCL4al0X1VhR7+B46YOJDn+jDRs1cF3oF6o9sWSW/YHo
owaBu6GDtEHEf/E69GBPP3dTghhtMY3RZQPFhARSvlnSy/HGg1C6fadR9c5/UiPU
wDs1FZqfMIdug/ngUrqDXTtlwPlw4l/nyZ/3V1SqLK4iO6cDaC8cZQUZlCPaLmVb
YZ/LsPeqc6xFg3j1rcjY8RrYNZhTiAiruZ8Avt53xo3THTUf4ABNK4OJqB0stmc=
=8H7s
- -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJX65ucAAoJEI4R3fMSeaKBAmQH/35z4x8kde8+qKNZxKPvIITs
ABY4G85erRDb92CJLcKtmvD4ZPcJBf6qZE5c/asi8WOrCrkhkgO7Dldobfth6r/j
3SZ0L0bm+m03w34up3sNfpu0HiWkWnhG7ZVtOlUZF8++lM7AQkhfjrpNfcyVV/7U
6upZtR9sFjCahvb3FUdmBhfvM/LBb4UORS86V1zWz/mqG9gTFAUpXBOdXqzH23NP
+5sdeFdzssp444BLdqwdNv2jPqUEguW67q5QChfelPITPFISHMoe6MA4bRQUgl4v
Sa7MLav889xNpnjz9NOb99c1PgDZ1S6gNvnxSqXqa+ISvPVlJPm+coaBjPqHHsE=
=QvcE
-----END PGP SIGNATURE-----

-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#39310

Dan Purgert wrote:
> Assuming 'time' works right... 
>
> Generating a 4096-bit key, on my laptop with the following system specs
> / utilization  (AFTER running 'time gpg --gen-key' and answering the
> prompts, because I didn't think beforehand)

Looks like it worked fine:

real    46m29.969s
user    0m5.472s
sys     0m0.020s


Wish I'd have checked my entropy pool beforehand to show what I was
starting from. Oh well, hindsight is 20/20.

-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#39312

On 2016-09-28 13:24, Dan Purgert wrote:
> Dan Purgert wrote:
>> Assuming 'time' works right... 
>>
>> Generating a 4096-bit key, on my laptop with the following system specs
>> / utilization  (AFTER running 'time gpg --gen-key' and answering the
>> prompts, because I didn't think beforehand)
> 
> Looks like it worked fine:
> 
> real    46m29.969s

46 minutes? Wow. I didn't remember it taking so long.

-- 
Cheers, Carlos.

[toc] | [prev] | [next] | [standalone]

#39328

Carlos E.R. wrote:
> On 2016-09-28 13:24, Dan Purgert wrote:
>> Dan Purgert wrote:
>>> Assuming 'time' works right... 
>>>
>>> Generating a 4096-bit key, on my laptop with the following system specs
>>> / utilization  (AFTER running 'time gpg --gen-key' and answering the
>>> prompts, because I didn't think beforehand)
>> 
>> Looks like it worked fine:
>> 
>> real    46m29.969s
>
> 46 minutes? Wow. I didn't remember it taking so long.
>

Most of the time was likely wasted in entropy collection.

I was only connected via SSH, and the computer wasn't doing much of
anything -- screen was only running slrn and irssi, dunno if there was
anything I forgot to close in X last night that may have still been up,
plus whatever I have running in the background.

-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#39329

Dan Purgert wrote:

> Most of the time was likely wasted in entropy collection.
>
> I was only connected via SSH, and the computer wasn't doing much of
> anything -- screen was only running slrn and irssi, dunno if there
> was anything I forgot to close in X last night that may have still
> been up, plus whatever I have running in the background.

I've been searching for rebuttals to the rngd urandom strategy described 
earlier.

The only disagreements I've been able to find are those which disagree 
with urandom.  That area seems like a religious war, with some people 
feeling pretty strongly against the man language.

The article I cited earlier cites Thomas Pornin (among others):

"The man page for urandom is somewhat misleading, arguably downright 
wrong, when it suggests that /dev/urandom may "run out of entropy" and 
/dev/random should be preferred;"  (originally at) 
http://security.stackexchange.com/questions/3936/is-a-rand-from-dev-urandom-secure-for-a-login-key/3939#3939

Another citation is:

Use urandom. Use urandom. Use urandom. Use urandom. Use urandom. Use 
urandom.


-- 
Mike Easter

[toc] | [prev] | [next] | [standalone]

#39333

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mike Easter wrote:
> Dan Purgert wrote:
>
>> Most of the time was likely wasted in entropy collection.
>>
>> I was only connected via SSH, and the computer wasn't doing much of
>> anything -- screen was only running slrn and irssi, dunno if there
>> was anything I forgot to close in X last night that may have still
>> been up, plus whatever I have running in the background.
>
> I've been searching for rebuttals to the rngd urandom strategy described 
> earlier.
>
> The only disagreements I've been able to find are those which disagree 
> with urandom.  That area seems like a religious war, with some people 
> feeling pretty strongly against the man language.


Typically, I generate "long-lived" keys (5 years+), so I prefer the
"yes, it's absolutely actually entropy" approach that /dev/random uses.

That being said, I don't know how much entropy the PC had available
before I started making that 4096-bit key.  I might've cleared it out
without realizing it, and started off with none (or close enough to none
that it doesn't really matter).


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBAgAGBQJX7D4eAAoJEI4R3fMSeaKB66EH/1MgSzT7gk7T7uk/Qd498ta/
ntDUc3ATPKGlGwF0nWQIAK8R3q0xs7wo/VWxq+lZRxkFSG1q7oRcE0hvyXKyAAeH
VnrPv1crUi2Rq/3yJn1ubG8S83cAGL6720Y1654WPSi9uJc745ApW6N6zBB5T5vE
7FMGrMZOFoKCJmeA6Jki8FdzXV8K6qeR9uyC3cGN9FFWDCajHCEfeCpbFUZNm2EN
MZn/ahE+OFjbMbL7HV4rGOzN140DwHG7o5iw7O76mzsqcPXZddNw0y+Pu8sxjbYN
tqEgBRF0QmguHbX1JiLaW5aaABphnEwBtFGMGY5BqeSQPz9Dt7sMIwnsWhJgl8A=
=WNRP
-----END PGP SIGNATURE-----

-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#39334

Dan Purgert wrote:
> That being said, I don't know how much entropy the PC had available
> before I started making that 4096-bit key.

This is what I think I know so far:

  - (I read) to make a 2048bit keypair gpg needs about 300bytes of 
random (assuming the rngd urandom strategy is not employed)

  - the entropy_avail number is bits, so 300bytes = 2400 bits

  - if I drain the entropy with cat /dev/random (and I am not employing 
the rngd urandom strategy), -1- the entropy builds back slowly and -2- 
trying to use anything that needs it gets blocked, perhaps 'hung'; 
earlier I was hung a long time before I quit after about 20 minutes

  - I don't know yet how much more bits entropy a 4096 keypair requires


-- 
Mike Easter

[toc] | [prev] | [next] | [standalone]

#39223

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mike Easter wrote:
> Mike Easter wrote:
>> My repo's gnupg is older (1.4.16) than required by the newest enigmail,
>> so I'm better off using the older enigmail from the repos:
>
> I'm running an older Mint 17.  Mint 18 & Ub 16.04 have newer gnupg 
> 2.1.11 (referred to as gnupg2) and enigmail 1.9.1.
>
Mint17 should have this as well.  Least I remember using gpg2 when I was
on mint (have since moved to Devuan, because systemd infection in LM18).


- -- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBAgAGBQJX6SHlAAoJEI4R3fMSeaKBjB0IAI8SI/mH+WTrEnaj21XaUkp6
Vt/++D8MAtxT0v+SPv9y305esEVPohJKrxTPVizEDPUJD/lZdrjfa25ftjqQ9bqj
Lz/Z4szOZkVJHcVwX+neYwLokPbwTzM2Gjl0lkqgFhIiFOG89Z44myoWVIzVNJ9o
AvyrzAAMx29Da9M07rGfAB4thoHxIzup0EzqQNBEWFCF7EfBX8kJ+fe41wiC+ayb
ckic5zaiZoKaO0Umshm6t0YA/sPnWmyhS+NoX73p9ArOW74JU03SWXTiDkiEQ0SA
sWuOI1yX5HwFWEwwxi72j7VeEogJR2Gi8MCj5fK2xcUkDsu13Ats9stJUtWPlAk=
=zBXe
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#39231

Dan Purgert wrote:
> Mint17 should have this as well.

Ah, so.  You are correct, sir.  (Old Ed McMahon line.)

It has the gnupg2, not the newer enigmail; but that is just an .xpi 
which can be fetched from enigmail.

-- 
Mike Easter

[toc] | [prev] | [next] | [standalone]

#39222

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mike Easter wrote:
> Dan Purgert wrote:
>> Marek Novotny wrote:
>
>>> The GnuPG is performed via a macro. If you're interested in added
>>> signing and verification to slrn yourself, see this macro download
>>> page:
>
>> Nice, have thought about seeking it out off and on myself.  Seems
>> like now's as good a time as any to enable it.
>
> For Tb (as opposed to slrn) users, the strategy is via gnupg and 
> enigmail in the repos.
>
> Alternatively, the enigmail .xpi Tb add-on can be downloaded from its 
> webpage.  The newest there is a newer v. than in my repos.
>
> My repo's gnupg is older (1.4.16) than required by the newest enigmail, 
> so I'm better off using the older enigmail from the repos:

I believe gnupg2.x is listed under "gpg2" (or something to that effect),
rather than "gpg".  Might be worth checking out.

- -- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBAgAGBQJX6SFwAAoJEI4R3fMSeaKBI78H/RXGYssGMH4/+QCpKKD5TQ7g
ZoWVssjf2GZcFzFEznZQTNOEwHkMfPZ8vm6WaKoEtslsBn8oNDItNUvfMq0pspgz
OOth6eWRoF6z7vsJTbx4URgiZkARbquKMn9nmeaTk+9l4/4yHVmYwVxAgWWR2jaC
3RLaPgLypxJuXbn1RPb8wfUAT2OH/7mmp14wKC0MR9qgobBJSF8AiIngGaDr7d2j
JrPj0MmU3zRtE7W8GPzi2DFOGD96bt3WfDIt54r0HZ8mzdMeLapU4fPZt6sybD4d
6lPiEEgstrUuly2njwfsvlWUWo2LzbyAwGlhQ2zk16rUUkFYW4RTo4xHZ2v9Dig=
=tqpz
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#39224

On 2016-09-26 12:53, Dan Purgert wrote:

> Nice, have thought about seeking it out off and on myself.  Seems like
> now's as good a time as any to enable it.  (Here's hoping it pulls the
> right key, so I don't look like a moron).

You have to upload it to one keyserver.

cer@Telcontar:~> gpg --recv-keys 8E11DDF31279A281
gpg: requesting key 1279A281 from hkp server pgp.mit.edu
gpgkeys: key 8E11DDF31279A281 not found on keyserver
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0
cer@Telcontar:~>

Till you do, we can not check it.

-- 
Cheers, Carlos.

[toc] | [prev] | [next] | [standalone]

Page 2 of 4 — ← Prev page 1 [2] 3 4  Next page →

Back to top | Article view | alt.os.linux

csiph-web