oss-sec mailing list archives
Re: Re: Recommendations GnuPG-2 replacement
From: ludo () gnu org (Ludovic Courtès)
Date: Fri, 08 Dec 2017 12:01:22 +0100
Hi Marcus, Marcus Brinkmann <marcus.brinkmann () ruhr-uni-bochum de> skribis:
I started neopg.io two months ago to provide a modern replacement for GnuPG. It will go back to a single-binary architecture like gpg1 was, but move forward on just about every other issue: * Written in C++ * based on the Botan crypto library instead of libgcrypt * typical library + CLI (with subcommands) architecture * better testing (CI, static analysis)
Given that you worked on GnuPG, can you give some background? It isn’t clear to me why using C++/Botan/CMake to give a “modern” feel (what does it mean?) will lead to “better” software (under which criteria?). The multiple-process design in GnuPG had clear justifications AFAIK—e.g., having ‘dirmngr’ and ‘gnupg-agent’ in separate address spaces makes sense from a security standpoint. Do you think these justifications no longer hold, or that the decisions were misguided? I’m also skeptical about “better testing” bit: GnuPG and libgcrypt are among the first pieces of software that crypto and security researchers look at, and they’re also the first ones to get fixes when new attack scenarios are devised. I’m sure you have a clear view on this but neopg.io doesn’t reflect that. Thanks, Ludo’.
Current thread:
- Re: Recommendations GnuPG-2 replacement, (continued)
- Re: Recommendations GnuPG-2 replacement halfdog (Dec 17)
- Re: Recommendations GnuPG-2 replacement Daniel Kahn Gillmor (Dec 18)
- Re: Recommendations GnuPG-2 replacement halfdog (Dec 18)
- Re: Recommendations GnuPG-2 replacement Daniel Kahn Gillmor (Dec 18)
- Re: Recommendations GnuPG-2 replacement Leonid Isaev (Dec 18)
- Re: Recommendations GnuPG-2 replacement halfdog (Dec 18)
- Re: Recommendations GnuPG-2 replacement Leonid Isaev (Dec 19)
- Re: Recommendations GnuPG-2 replacement halfdog (Dec 17)
- Re: Recommendations GnuPG-2 replacement Solar Designer (Dec 22)
- Re: Recommendations GnuPG-2 replacement Dhiru Kholia (Dec 22)
- Re: Re: Recommendations GnuPG-2 replacement Ludovic Courtès (Dec 08)
- Re: Re: Recommendations GnuPG-2 replacement Marcus Brinkmann (Dec 08)
- Re: Re: Recommendations GnuPG-2 replacement Jeffrey Walton (Dec 10)
- Re: Re: Recommendations GnuPG-2 replacement Marcus Brinkmann (Dec 10)
- Re: Re: Recommendations GnuPG-2 replacement Phil Pennock (Dec 10)