Encryption and Identity Verification
From Guardian Project Wiki
Using QR Codes and camera QR code readers, the mobile phone can be the easiest tool for managing PGP signatures for building a web of trust.
Contents |
PGP implementations
gnupg-for-java
- JNI wrapper for gpgme
- gnupg-for-java
STEED
- http://g10code.com/steed.html
- initiative to make OpenPGP more accessible to novices
- LWN article: STEED: End-to-end email encryption
APG
- limitations:
- no method for uploading personal public key
- no method for signing other people's keys
- no method to view signatures on a key
- no PGP/MIME support
Didisoft OpenPGP Library for Java
- http://www.didisoft.com/java-openpgp/
- proprietary
- seems to lack:
- methods to talk with keyservers
- methods for managing key certification signatures
PGP Featureset Assessment
| Feature Description | OpenPGP | APG | Usage Frequency | Strategic Value |
|---|---|---|---|---|
| Key Generation* |  |  | Low | High |
| Encrypting / Signing | | | | |
| Standalone files | | | Low | Low |
| Email body | | | High | High |
| Email attachments | |  | High | High |
| Keyserver Integration | | | | |
| Upload public key | | | Low | High |
| Search / download public key | | | Medium | High |
| Upload/download signature certifications | | | Medium | Med |
| Key revocation | | | Low | High |
| Key Management | | | | |
| View / delete third party keys | | | High | High |
| Import / Export sub-keys | | | Low | High |
| Trust Management | | | | |
| Key signature viewing | | | Med | Med |
| Visible chain of trust | | | High | High |
/*APG describes key generation feature as "still kind of beta"
PGP data and meta data
Anonymous Web of Trust
While the PGP public infrastructure is very useful and easy to use, it also provides complete social graphs to the public. For many people, this will put them at high risk, so we should use techniques for an anonymous web of trust. Or at least not making the social graph available to people outside of that social graph.
- Anonymous Web of Trust prototype lib
- mode for exclusive, p2p syncing of signatures, no uploads to PGP servers
- gnupg lsign "sign a key locally"
- A conversation with dkg on p2p PGP sig swaps
- caff emails the sigs instead of posting them to the keyserver
- allows keyholder to decide how the sig is distributed
- Evolution supports directly importing the sigs from the emails
- So does thunderbird w/ enigmail
- computer needs working SMTP server
- Anymime Key Signing Party Android Key Signing GUI which posts sigs via scp
- avoiding tracking connections to PGP servers
- HTTPS to prevent snooping of data
- Tor to prevent tracking of notable IPs
- Hidden tor service descriptor baked into key (todo: flesh this out)
CAcert Certificate Authority Infrastructure
- http://cacert.org
- Firefox can update CAcert's revoke list once a day
- Firefox can enforce OCSP cert revokations
- can we specify one trustworthy OCSP server for all CAs?
PGP master key with sub keys for daily use
- http://www.macfreek.nl/mindmaster/Convert_GPG_keys_to_subkeys
- Using multiple subkeys in GPG
- GPG subkey tutorials
- Convert GPG keys to subkeys
- Convert keys between GnuPG, OpenSsh and OpenSSL
OTR syncing
Handling Verification Signatures
- ssh randomart for fingerprints for making it easier to recognize fingerprints
- visprint - fractal fingerprint generator
- make easy UI for sending signatures via email ala caff instead of directly to the keyserver like Seahorse
Converting OTR formats
- integrating OTR keys into PGP keys
- Understanding DSA keys
- keyCzar Python/Java/C++ framework for crypto
- Initial discussion about integrating OTR keys into PGP key
- M2Crypto convert key from PEM to DER (python)
- X.509 Certificate and Key Formats
- Crypto++ wiki: Keys and Formats
- Cryptographic Interoperability: Keys
- Cryptographic Interoperability: Digital Signatures
