Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5626

Re: PGP/GnuPG unsecure, should be replaced?

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Why do you think that TwoFish is bad? It was invented by Bruce Schneier 
and was in the last round of the AES competition. I believe it to be the 
better choice than AES.

Am 20.07.19 um 21:41 schrieb Iain Grant:
> 2 fish... that in it's self is bad.  AES, sure lets all be ok about that.
>
> I also read the article and I realise I still rely on gpg far too much 
> and that I need to ween myself off of it!
>
>
> Iain
>
> On Sat, Jul 20, 2019 at 8:33 PM qmi (list) <lista@miklos.info 
> <mailto:lista@miklos.info>> wrote:
>
>     Hi,
>
>     On 7/19/19 1:34 PM, Stephan Seitz wrote:
>     > I found the following article about PGP/GnuPG:
>     > https://latacora.singles/2019/07/16/the-pgp-problem.html
>     >
>     > In short you should drop GnuPG because it doesn’t do anything
>     really
>     > the right way. It should be replaced with different tools for
>     > different situations.
>
>     I checked that article. For e.g. the article says, "If you’re lucky,
>     your local GnuPG defaults to 2048-bit RSA, the 64-bit-block CAST5
>     cipher
>     in CFB, ..."
>
>     Wrong. The current implementation of GnuPG shipped by Debian Buster -
>     version 2.2.12 - does support modern cryptographic standards for
>     symmetric encryption, not only CAST5. For e.g., it does support
>     twofish
>     and aes. Both of which use 128-bit block sizes, AFAIK. See command
>     output for gpg below about supported algorithms:
>
>     "
>
>     qmi@qmiacer:~$ gpg --version
>
>     gpg (GnuPG) 2.2.12
>     (...)
>     Supported algorithms:
>     Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
>     Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
>              CAMELLIA128, CAMELLIA192, CAMELLIA256
>     (...)
>     "
>
>     So it's good enough, apparently.
>
>     >
>     > Debian is using GnuPG for signing files. From the article:
>     >
>     > Signing Packages
>     >
>     > Use Signify/Minisign. Ted Unangst will tell you all about it.
>     It’s what
>
>     You may be right, though. That tool might have better bindings for
>     modern programming languages.
>
>     Regards,
>     --
>     qmi
>     Email: lista@miklos.info <mailto:lista@miklos.info>
>

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

PGP/GnuPG unsecure, should be replaced? Stephan Seitz <stse+debian@fsing.rootsland.net> - 2019-07-19 13:50 +0200
  Re: PGP/GnuPG unsecure, should be replaced? "qmi (list)" <lista@miklos.info> - 2019-07-20 21:40 +0200
    Re: PGP/GnuPG unsecure, should be replaced? Iain Grant <iain@panfantastic.co.uk> - 2019-07-20 22:10 +0200
      Re: PGP/GnuPG unsecure, should be replaced? Elmar Stellnberger <estellnb@gmail.com> - 2019-07-21 21:20 +0200
        Re: PGP/GnuPG unsecure, should be replaced? Iain Grant <iain@panfantastic.co.uk> - 2019-07-21 23:40 +0200
    Re: PGP/GnuPG unsecure, should be replaced? Malte <malte@wk3.org> - 2019-07-21 16:50 +0200
      Re: PGP/GnuPG unsecure, should be replaced? qmi <lista@miklos.info> - 2019-07-21 18:30 +0200
  Re: PGP/GnuPG unsecure, should be replaced? Pieter le Roux <pgp@myleroux.net> - 2019-07-25 10:00 +0200
    Re: PGP/GnuPG unsecure, should be replaced? Volker Birk <vb@pep-project.org> - 2019-07-25 15:30 +0200

csiph-web