OpenPGPjs v3.0(protonmail.com) |
OpenPGPjs v3.0(protonmail.com) |
Currently, ProtonMail uses RSA keys, but this addition of ECC support to their web encryption library may mean that they are about to start switching users to ECC keys. Because using "larger" (when compared with equivalent theoretical strength RSA keys, for example) ECC keys is less resource intensive than using higher security keys in some other forms of cryptosystems (like RSA) it may also be an indication that ProtonMail is preparing to upgrade users to higher security/stronger keys.
Many cryptographers and organizations, including the US Government, have recommended for a long time that people migrate from older "big prime cryptography" based cryptosystems to ECC based cryptosystems for increased security.
Not what I've heard.
https://threatpost.com/nsas-divorce-from-ecc-causing-crypto-...
Personally I'd stay away from NIST recommended curves for long term keys (as used in OpenPGP). Ed25519 looks nice and there is experimental support for it in gnupg but it's not post quantum unfortunately.
That's not a problem of NIST recommendations. There aren't any post-quantum secure elliptic curve public-key systems. The fundamental computational problem used by ECC public-key cryptography isn't post-quantum secure, so it's not really a matter of curve choice.
Wow...I'm sort of shocked that wasn't a v1.0 consideration.
> ECC tends to be able to provide equivalent levels of security as traditional "big prime" cryptography (like RSA) with less computationally intensive operations. This is especially important in a library like OpenPGPjs that is primarily meant for in browser based web usage because it should make things, like sending and receiving mail, faster when ECC is used over older PGP public key encryption systems. For people that use ProtonMail's web based crypto on mobile or tablet devices, a switch to ECC would result not just in similar performance improvements but also in lower battery usage.
In particular, elliptic curves have smaller parameters, which allow for smaller keys at the same bit security level. For example, to achieve 128-bit security, an RSA/DLP modulus must be 3072 bits. Elliptic curves achieve the same security level with only 256-bit parameters. They are also faster for most operations, but RSA is still technically faster for signature verification.
> Many cryptographers and organizations, including the US Government, have recommended for a long time that people migrate from older "big prime cryptography" based cryptosystems to ECC based cryptosystems for increased security.
True, but elliptic curve cryptography is just as vulnerable to quantum computers, however long off that problem may be.
Given that you need to pass --expert to gpg 2.1 as of right now to even generate an ECC keypair for PGP use (nor use one on an OpenPGP smartcard or yubikey), I can sort of forgive the lack of ECC in 1.0. I don't think it sees wide usage for PGP keys (some clients don't support it, also).
However, as of the last time I tried Protonmail (about 10 minutes ago to check this is all still true) you can't: revoke/reissue your PGP key, validate outside signatures (either on encrypted messages or signed, plaintext messages) or send pure-PGP mail to users outside of protonmail (there's an encrypt for non-protonmail users option, that sends a link instead). Essentially as another commenter has said, you can't really do PGP with ProtonMail.
My company contributed the ECC support for enabling messaging using the same keys as Bitcoin and other cryptocurrencies. See https://news.ycombinator.com/item?id=16548015
The canonical example that IMO doesn't make sense is when Alice and Bob want to communicate privately using Eve as an webmail provider who wants to snoop in on the communications. Alice and Bob can't just trust Eve to provide a copy of OpenPGPjs in a <script> tag on EveMail.com, because then they're trusting Eve to provide a legitimate PGP implementation, trusting Eve not to log their keystrokes in JS, etc.
I can understand OpenPGPjs as a server-side library in Node (though I suspect it would be safer to run a battle-hardened library like GPG with node FFI).
But, in client-side web code, how could this ever make sense?
https://github.com/kylehuff/webpg-chrome
We deserve a better userspace from our browsers. The excuse that "users" don't want this because its "hard" is circular.
No data is lost or stolen. Customers won't like it, you may lose sales, etc, but your data security is fine.
It's shocking how much sensitive data is sent by mail (contracts, passwords, lawyers, etc..) without pgp signing / encryption on a daily basis.
From Alice's point of view, she is just using webmail as she always has, except now she has the assurance that no one (other than Eve) can spoof Bob's identity, and that Bob's mail server isn't reading the messages she sends him (unless Eve is deliberately leaking the plaintext somehow despite sending Bob the encrypted version).
Long term it would be nice if the W3C's SRI standard was extended to allow offline signing of JavaScript files:
https://github.com/w3c/webappsec/issues/449
and for browsers to prompt you whether you wanted to run a new (offline signed, maybe independently audited) version of those files.
If Carol or Chuck can spoof Eves "identity" they can spoof Bobs identity. This can be done in a multitude of technical or social ways.
Is it better to have this than nothing? The problem is that you have to trust your whole infrastructure if you want to do this kind of client side encrypting.
One would of course still need a protection against key logging etc. (eventually the web extension has relevant matter only in a pop-up?)
What might help is a browser extension that tracks changes and allows you to “lock” into a version of a website.
This is pretty much what browser extensions do; bottle up some hypertext resources, signed and versioned.
You still have three obvious threats: local superuser can read application memory etc; your local user can read your memory and any browser compromise/bug can likely read your browser/session data.
The real question is if the browser sandbox is ever likely to be good enough that you don't have to worry about a font file from a compromised website about kittens reading your email in another tab.
The comment about post quantum crypto did not relate to ECC directly. I just would like to see some PQ crypto in OpenPGP :)
And people trust them!?
(FYI: It is customary here on HN to disclose any affiliations when commenting.)
Fwiw, while I'm not that interested in the current project - I actually think it's great to build a walled garden on open standards - especially for secure services. Makes it easier to evaluate, and opens the door fore secure interop in the future.
It's not clear whether we can currently create a machine with sufficient logical qubits to run Shor's algorithm in a meaningful way.
However, out of an abundance of caution, we're "starting" now (some designs have existed for longer but this (NIST PQC) is the first competition, which focuses minds) so as to have something ready when/if a quantum computer becomes a reality.
A DARPA researcher explained to me that a quantum computer's qbits would have to be 99.9999999999% error-free (that's 12 nines) in order to perform the necessary steps of Shor's quantum factorization algorithm. Current state of the art qbits are 99.9-99.99% error-free. Basically, we have a long way to go.