Difference between revisions of "PGP"
(→References) |
(→Full Title or Meme) |
||
| Line 1: | Line 1: | ||
==Full Title or Meme== | ==Full Title or Meme== | ||
[[PGP]] or pretty good privacy, as an early attempt to create secure email with no central control. | [[PGP]] or pretty good privacy, as an early attempt to create secure email with no central control. | ||
| + | |||
| + | ==Chris Allen== | ||
| + | The key thing you need to know is that most security people now say that PGP/GPG should not be used for email. See: | ||
| + | https://www.wired.com/story/efail-pgp-vulnerability-outlook-thunderbird-smime/ which highlights inherent issues with PGP, such as its age, complexity, and lack of forward secrecy, making it less suitable for modern secure communications. | ||
| + | |||
| + | The main value of GPG in the last decade has been for file signing, as git has supported it for some time. For instance, Bitcoin has an elaborate GPG multiparty signing process of tagged releases. See the most SHA256SUMS files in the most recent tagged release at https://bitcoincore.org/bin/bitcoin-core-28.0/, and the process has become fairly arcane, see: https://coinguides.org/verify-bitcoin-core-signatures/ | ||
| + | |||
| + | However, git introduced support for signing commits and tags with SSH keys in version 2.34.0 (November 15, 2021), leveraging OpenSSH's data-signing capabilities introduced in OpenSSH 8.0. GitHub began supporting SSH commit verification on August 23, 2022, followed by GitLab in version 15.7, released on December 22, 2022. These developments allow developers to use SSH keys for both authentication and commit signing, simplifying code authenticity verification. SSH also now offers support for many cryptosystems, including some that are quantum resistant. | ||
| + | |||
| + | At Blockchain Commons, we currently use both SSH detached signatures for signing tagged releases of more security sensitive applications. For instance, see all the attached files in https://github.com/BlockchainCommons/GordianServer-macOS/releases/tag/v1.1.0. Our goal is to eventually have all of our tagged releases use a verifiable approach including not just apps but also all our libraries. On our roadmap in 2025 are better build tools to make this easier. | ||
| + | |||
| + | I have two gists about Git and SSH signing. Note that I use gists for rough drafts, notes and lists, and they have not been reviewed. | ||
| + | |||
| + | - SSH Keys Best Practices https://gist.github.com/ChristopherA/3d6a2f39c4b623a1a287b3fb7e0aa05b | ||
| + | - Links regarding SSH Signing Best Practices: https://gist.github.com/ChristopherA/3d6a2f39c4b623a1a287b3fb7e0aa05b | ||
| + | |||
| + | I have a bunch of other SSH related gists available at https://gist.github.com/search?q=user%3Achristophera+ssh | ||
==References== | ==References== | ||
Revision as of 19:00, 15 December 2024
Full Title or Meme
PGP or pretty good privacy, as an early attempt to create secure email with no central control.
Chris Allen
The key thing you need to know is that most security people now say that PGP/GPG should not be used for email. See: https://www.wired.com/story/efail-pgp-vulnerability-outlook-thunderbird-smime/ which highlights inherent issues with PGP, such as its age, complexity, and lack of forward secrecy, making it less suitable for modern secure communications.
The main value of GPG in the last decade has been for file signing, as git has supported it for some time. For instance, Bitcoin has an elaborate GPG multiparty signing process of tagged releases. See the most SHA256SUMS files in the most recent tagged release at https://bitcoincore.org/bin/bitcoin-core-28.0/, and the process has become fairly arcane, see: https://coinguides.org/verify-bitcoin-core-signatures/
However, git introduced support for signing commits and tags with SSH keys in version 2.34.0 (November 15, 2021), leveraging OpenSSH's data-signing capabilities introduced in OpenSSH 8.0. GitHub began supporting SSH commit verification on August 23, 2022, followed by GitLab in version 15.7, released on December 22, 2022. These developments allow developers to use SSH keys for both authentication and commit signing, simplifying code authenticity verification. SSH also now offers support for many cryptosystems, including some that are quantum resistant.
At Blockchain Commons, we currently use both SSH detached signatures for signing tagged releases of more security sensitive applications. For instance, see all the attached files in https://github.com/BlockchainCommons/GordianServer-macOS/releases/tag/v1.1.0. Our goal is to eventually have all of our tagged releases use a verifiable approach including not just apps but also all our libraries. On our roadmap in 2025 are better build tools to make this easier.
I have two gists about Git and SSH signing. Note that I use gists for rough drafts, notes and lists, and they have not been reviewed.
- SSH Keys Best Practices https://gist.github.com/ChristopherA/3d6a2f39c4b623a1a287b3fb7e0aa05b - Links regarding SSH Signing Best Practices: https://gist.github.com/ChristopherA/3d6a2f39c4b623a1a287b3fb7e0aa05b
I have a bunch of other SSH related gists available at https://gist.github.com/search?q=user%3Achristophera+ssh
