← Feed

Posts

• View post

  @jonah this is definitely a hard time to feel hopeful about tech. My silver linings perspective is that we're collectively getting a lot of new clarity about what we disagree with, and what world we'd prefer to inhabit instead. Some of the "evils" are new, but many have been here a long time, and we've just gotten better at seeing them with a critical eye. Maybe this depressing moment is a necessary intermediate step towards making a better tech world...

• View post

  Apparently the so-called "schism" in #OpenPGP is over. Context: In 2022, an email to the IETF OpenPGP working group list, titled "a new draft overlapping the WG draft", noted that one implementation (GnuPG) seemed to reject the draft that is now RFC 9580: https://mailarchive.ietf.org/arch/msg/openpgp/PWp3ZcZ_qnDNLhuT-zR7gA2ddeg/ Today, the author of #GnuPG signaled on the IETF list that he intends to implement support for RFC 9580 and draft-ietf-openpgp-nist-bp-comp: http...

• View post

  Over the last half week, I've implemented very barebones #OpenPGP card support in @minipgp6@floss.social Support is limited to Ed25519 and X25519 (since that's the intersection of what minipgp supports and what current cards support). As expected, there is no fundamental obstacle that prevents use of existing OpenPGP card devices with v6 keys. #rfc9580

• View post

  The openpgp-card-state crate now has a new "ephemeral" backend: https://codeberg.org/openpgp-card/state/#ephemeral-interactive-input-with-persistence-and-expiry This combines the defensiveness of unpersisted pinentry with the convenience of caching (in the Linux kernel credential store, for a configurable duration). New releases of https://crates.io/crates/openpgp-card-tool-git, https://crates.io/crates/openpgp-card-ssh-agent, https://crates.io/crates/rsop-oct support this n...

• View post

  Regular PSA reminder: While GnuPG 2.5.x implements hybrid PQC encryption based on ML-KEM, just like https://datatracker.ietf.org/doc/draft-ietf-openpgp-pqc/, GnuPG's implementation is entirely incompatible with the IETF-specified format, which all other libraries are implementing. Both serialization and the KEM combiners differ. The bottom line is that anyone who wants to use vendor-agnostic PQC with OpenPGP should *avoid GnuPG's PQC key formats*. This is all exceedingly unfor...

• View post

  @hipsterelectron once the dust around the base minipgp6 stack settles, I plan to write a convenience crate for AC2 key generation and rotation. Would love to hear your thoughts when you read the draft!

• View post

  @hipsterelectron have you seen https://datatracker.ietf.org/doc/draft-autocrypt-openpgp-v2-cert/ ?

• View post

  @hipsterelectron thank you! this needs so much work still, but it's such a relief to have put this initial version out in the world! ... a very smol pgp! 🥺🔏

• View post

  I just released a first draft version of #minipgp6 https://floss.social/@minipgp6/116500687374282691 minipgp6 is an intentionally small #OpenPGP library stack. It implements v6 formats from https://www.rfc-editor.org/rfc/rfc9580 and #PQC composite key algorithms from https://datatracker.ietf.org/doc/draft-ietf-openpgp-pqc/ The complete library stack in this release adds up to ~5k LOC. It interoperates with all modern OpenPGP libraries: https://codeberg.org/minipgp6/minipgp6#interop A SOP CL...

• View post

  RE: https://fosstodon.org/@foss_north/116476608857157107 Yay for @dvzrv 's tireless(*) work towards modernizing how OpenPGP is used in distro contexts (including in Arch Linux). I've spent some time last year hacking on https://devblog.archlinux.page/2026/verify-arch-linux-artifacts-using-voa-openpgp/ with David, which was a great time. VOA is the other side of the coin to Signstar - the former verifies signatures, while the latter produces them. --- (*) Although I do suspec...

• View post

  I just released version 0.1.9 of rsop-oct, a stateless #OpenPGP ("SOP") CLI tool for use with OpenPGP card hardware devices: https://crates.io/crates/rsop-oct/ Like its sibling project #rsop, rsop-oct is based on @rpgp This version improves error handling and reporting in some cases, in particular when a suitable card is not found, or the User PIN for a card is not available. For more on #SOP, see https://datatracker.ietf.org/doc/draft-dkg-openpgp-stateless-cli/ #PGP #GnuP...

• View post

  I just released version 0.1.7 of rsop-oct, a stateless #OpenPGP ("SOP") CLI tool for use with OpenPGP card hardware devices: https://crates.io/crates/rsop-oct/ Like its sibling project #rsop, rsop-oct is based on @rpgp This update adds (initial) support for the SOP command 'update-key'. This command allows extending the expiration times of components of an OpenPGP certificate using a primary key that is stored on an OpenPGP card device. For more on #SOP, se...

• View post

  The https://freepg.org/ project maintains patches against #GnuPG with the goal of closer adherence to the IETF #OpenPGP spec. One currently open question is if/how draft-ietf-openpgp-pqc support could be realistically added to #FreePG I've started https://codeberg.org/freepg/freepg-draft-ietf-openpgp-pqc first of all as a notes-to-self repo for a (presumably very slow and long-term) side quest to explore this problem. Specifically, the goal would be adding support for v4 ML-KEM-768+X2...