oss-sec mailing list archives
Re: Recommendations GnuPG-2 replacement
From: Jeremy Stanley <fungi () yuggoth org>
Date: Thu, 7 Dec 2017 15:15:06 +0000
On 2017-12-07 06:32:11 +0000 (+0000), halfdog wrote: [...]
For all steps regarding system startup, I switched to LUKS only, using detached headers for special features. For release signing, mail sign/encrypt, a good light-weight solution is still needed.
[...] I continue to use gpg2 in a release signing context, but strip symmetrical encryption from the private signing subkey with a custom keyring due to it being used by a headless/automated CI system which runs on virtual machines that get deleted as soon as the signature is generated thus leaving keys in memory isn't a concern there (and the master private key _is_ encrypted but only ever used to create signing subkeys and never goes anywhere near the CI system). Sounds like my use case is likely not your use case, so perhaps you should look at the signify utility OpenBSD developed for this purpose instead? It's included in Debian since Stretch under the package name "signify-openbsd" and seems to work well; I've used it semi-regularly as I tend to do a lot of cross-platform things in a mixed Debian/OpenBSD environment. For E-mail I'll confess I still use mutt's (well, neomutt's at least) GnuPG integration, which has been working okay for me with gpg2 on Debian. I haven't seen a lot of good OpenPGP implementations besides GnuPG with at least equal levels of PGP/MIME integration there. The obvious alternative is switching to S/MIME but you've likely already considered that and the never-ending TTP vs WoT debate, not to mention Debian as a community is fairly invested in OpenPGP keys as a means of identifying and authenticating its developers/maintainers. -- Jeremy Stanley
Attachment:
signature.asc
Description: Digital signature
Current thread:
- Recommendations GnuPG-2 replacement halfdog (Dec 06)
- <Possible follow-ups>
- Re: Recommendations GnuPG-2 replacement oss-security (Dec 07)
- Re: Recommendations GnuPG-2 replacement halfdog (Dec 15)
- Re: Recommendations GnuPG-2 replacement Jeremy Stanley (Dec 07)
- Re: Recommendations GnuPG-2 replacement halfdog (Dec 15)
- Re: Recommendations GnuPG-2 replacement Solar Designer (Dec 07)
- Re: Recommendations GnuPG-2 replacement Peter Bex (Dec 07)
- Re: Recommendations GnuPG-2 replacement Blibbet (Dec 07)
- Re: Recommendations GnuPG-2 replacement Solar Designer (Dec 07)
- Re: Recommendations GnuPG-2 replacement halfdog (Dec 17)
- Re: Recommendations GnuPG-2 replacement Daniel Kahn Gillmor (Dec 18)
- Re: Recommendations GnuPG-2 replacement halfdog (Dec 18)
- Re: Recommendations GnuPG-2 replacement Daniel Kahn Gillmor (Dec 18)
- Re: Recommendations GnuPG-2 replacement Leonid Isaev (Dec 18)
- Re: Recommendations GnuPG-2 replacement Peter Bex (Dec 07)