Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5625

Re: PGP/GnuPG unsecure, should be replaced?

Show all headers | View raw

Hi

On 7/21/19 4:34 PM, Malte wrote:
> lista@miklos.info transcribed 1.4K bytes on 20-Jul-2019 21:25:
>> I checked that article. For e.g. the article says, "If you’re lucky, your
>> local GnuPG defaults to 2048-bit RSA, the 64-bit-block CAST5 cipher in CFB,
>> ..."
>>
>>
>> "defaults to" and "supports" are two different words with two different
>> meanings. GnuPG's history is full of new features getting developed
>> while insecure defaults being kept.

Thanks for pointing out. Correct, I was not specific enough. GnuPG 
*defaults* to AES-128 when using symmetric encryption according to its 
manual page. In practice, it appears to be using AES-256. I would be 
surprised if the GnuPG version shipped by the most developer-friendly 
Linux OS on the planet defaulted to a 64-bit block cipher. Perhaps an 
earlier version of GnuPG did default to CAST5 block cipher, as Wikipedia 
article states.

qmi

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

PGP/GnuPG unsecure, should be replaced? Stephan Seitz <stse+debian@fsing.rootsland.net> - 2019-07-19 13:50 +0200
  Re: PGP/GnuPG unsecure, should be replaced? "qmi (list)" <lista@miklos.info> - 2019-07-20 21:40 +0200
    Re: PGP/GnuPG unsecure, should be replaced? Iain Grant <iain@panfantastic.co.uk> - 2019-07-20 22:10 +0200
      Re: PGP/GnuPG unsecure, should be replaced? Elmar Stellnberger <estellnb@gmail.com> - 2019-07-21 21:20 +0200
        Re: PGP/GnuPG unsecure, should be replaced? Iain Grant <iain@panfantastic.co.uk> - 2019-07-21 23:40 +0200
    Re: PGP/GnuPG unsecure, should be replaced? Malte <malte@wk3.org> - 2019-07-21 16:50 +0200
      Re: PGP/GnuPG unsecure, should be replaced? qmi <lista@miklos.info> - 2019-07-21 18:30 +0200
  Re: PGP/GnuPG unsecure, should be replaced? Pieter le Roux <pgp@myleroux.net> - 2019-07-25 10:00 +0200
    Re: PGP/GnuPG unsecure, should be replaced? Volker Birk <vb@pep-project.org> - 2019-07-25 15:30 +0200

csiph-web