Re: Series of minor questions about OpenPGP 1

Hi. I've just made some tests. And it showed that anybody can change the paket header from old to new for any key (even without the secret key). Of course I've expected this, but is this the case for all signature types, that gnupg doesn't include the paket header in the signing but just the

Re: Series of minor questions about OpenPGP 1

On Jan 28, 2009, at 6:05 AM, Peter Thomas wrote: Hi. I've just made some tests. And it showed that anybody can change the paket header from old to new for any key (even without the secret key). Of course I've expected this, but is this the case for all signature types, that gnupg doesn't

Series of minor questions about OpenPGP 5

Hi. Now this is surely gnupg specific again ;-) Ok let me see... 1) When creating keys or other data which needs random numbers, how is this done in gnupg? I mean does it per default use /dev/random? Or does it have its own means like a modified Mersenne Twister or whatever? I wonder because

Re: Series of minor questions about OpenPGP 5

On Wed, 28 Jan 2009 15:59, p4.tho...@googlemail.com said: 1) When creating keys or other data which needs random numbers, how is this done in gnupg? I mean does it per default use /dev/random? Or does it have its own means like a modified Mersenne Twister or whatever? Read the manual of

Re: Series of minor questions about OpenPGP 5

Hello Werner. On Wed, Jan 28, 2009 at 5:10 PM, Werner Koch w...@gnupg.org wrote: Read the manual of libgcrypt 1.4.4 - it includes a description of the RNG. The code in 1.4 is basically the same. That's what I was looking for :-) These levels described on

Re: Series of minor questions about OpenPGP 5

Werner has already answered most of this, so I'll confine my remarks to just this -- 1) When creating keys or other data which needs random numbers, how is this done in gnupg? I mean does it per default use /dev/random? Or does it have its own means like a modified Mersenne Twister or

Re: Series of minor questions about OpenPGP 5

Peter Thomas wrote: I've read about special hardware devices that (claim to) give true random numbers, some based on thermodynamics some even on quantum mechanics. True randomness exists in nature, but so far we're unable to detect it. (Seriously.) Imagine you have a Geiger counter and a

Re: Series of minor questions about OpenPGP 5

2009/1/28 Peter Thomas p4.tho...@googlemail.com: Now this is surely gnupg specific again ;-) Please please please stop starting new threads! It makes it much easier for me to ignore if you keep to just the one. Ben ___ Gnupg-users mailing list

Re: Series of minor questions about OpenPGP 5

On Wednesday 28 January 2009, Robert J. Hansen wrote: Peter Thomas wrote: I've read about special hardware devices that (claim to) give true random numbers, some based on thermodynamics some even on quantum mechanics. True randomness exists in nature, but so far we're unable to detect

randomness // how important is it 'really', if it's not *absolutely* random ?

if the randomness collected for generation of a gnupg session key, isn't *absolutely* random, then it may introduce a bias whereby the session key space can be theoretically be able to be attacked by a 'better-than-brute-force' method, by selectively concentrating on the possibilities the bias

Re: randomness // how important is it 'really', if it's not *absolutely* random ?

ved...@hush.com wrote: [...] how much of a threat is this really, given the nature of how gnupg collects random data on the various computer platforms? I don't have the math or crypto background to answer you definitively, but I feel confident that *today* the difference between the

Re: randomness // how important is it 'really', if it's not *absolutely* random ?

ved...@hush.com wrote: if the randomness collected for generation of a gnupg session key, isn't *absolutely* random, then it may introduce a bias whereby the session key space can be theoretically be able to be attacked by a 'better-than-brute-force' method, by selectively concentrating on

Re: Series of minor questions about OpenPGP 5

-- Forwarded message -- From: Ingo Klöcker kloec...@kde.org To: gnupg-users@gnupg.org Date: Wed, 28 Jan 2009 21:09:38 +0100 Subject: Re: Series of minor questions about OpenPGP 5 On Wednesday 28 January 2009, Robert J. Hansen wrote: Peter Thomas wrote: I've read about

Selection of digest algorithm

Hi gnupg-users! I noticed some oddities (to me) with the selection of a hash algorithm by GnuPG. I assume that the particular use-cases have additional limitations which are not obvious to me, so could you please clarify? First, when sending a signed email from Evolution, SHA1 seems to be

Re: Selection of digest algorithm

Sven Radde wrote: First, when sending a signed email from Evolution, SHA1 seems to be chosen, no matter what personal-digest-preferences or even digest-algo is set in the gpg.conf file (other parts of gpg.conf are honored, however). Is this a limitation of the PGP/MIME standard that Evolution

Re: Selection of digest algorithm

On Jan 28, 2009, at 6:06 PM, Sven Radde wrote: Hi gnupg-users! I noticed some oddities (to me) with the selection of a hash algorithm by GnuPG. I assume that the particular use-cases have additional limitations which are not obvious to me, so could you please clarify? First, when sending a

Re: Series of minor questions about OpenPGP 5

Hi, I wonder because I'd to test the used source with this http://www.cacert.at/random/ so is there perhaps some function in gpg That are plainstupid tests. Yes, I agree. I haven't discovered any intelligent algorithms yet, only statistical tests seem to be available. If anyone knows