Re: Long Term Key Management With Hardware Tokens
Brandon Anderson via Gnupg-users writes: > Thanks for posting about the PivApplet project. I was looking for > something like that for either the basic cards or java cards as I > wanted to tinker around with them. Do you have a specific Java card > model you are using? You'll want something that implements at least JavaCard 3.0.4, since that's the first version with useful EC operations. This came out in 2011 but because smartcards move at a glacial place there are still a lot of 2.x cards on the market. The NXP J3H145 appears to be a popular and widely available dual-interface card. There is some discussion regarding cards on the SmartPGP applet issue tracker: https://github.com/ANSSI-FR/SmartPGP/issues/17 . I haven't tried other Javacards besides the J3H145. They work well, though a caveat is that they are quite slow compared to for example a Yubikey 5: operations take approximately twice as long. The J2H145 should be pretty much identical but lacks the contactless interface and is a bit cheaper. The newer J3R180 is supposedly quite a bit faster. Unless you're buying large quantities and are prepared to deal with weighty NDAs, make sure that the seller performs card initialization/pre-personalization. GlobalPlatform tools won't be able to access the card before this step. Most stores that sell single cards will do this by default, but eBay/Aliexpress sellers might not. -Valtteri ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: Long Term Content Protection
> On 26 Jun 2021, at 08:26, LisToFacTor via Gnupg-users > wrote: > > Once a message reaches > the recipient's operational environment, it should be decrypted, > and its further protection is best addressed as part and parcel > of the protection of that complete environment. But this is not the way many people use email now. It is quite common to use multiple “operational environments” to access a common user mailbox, and that mailbox may not be under the user’s sole control. Any security model must take into account how people lready behave in practice… otherwise they will use insecure workarounds. A ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Long Term Content Protection
There is, perhaps, a wider perspective on the problem discussed in this thread. GPG is a reasonable tool for the protection and verification of content exchanged between two parties. Once a message reaches the recipient's operational environment, it should be decrypted, and its further protection is best addressed as part and parcel of the protection of that complete environment. After all, a message of any consequence will likely result on secondary content generated by and on the recipient's computer, that needs as much (or more) protection as the message content in transit. There are many tools and techniques for achieving that, but their use and best practices are beyond the scope of this list. ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
