On Fri, 1 Aug 2014 12:50:20 +0000 (UTC) intrigeri <[email protected]> wrote:
> Hi, > > intrigeri wrote (14 Jul 2014 10:38:47 GMT) : > > Also, I would find it good to be even closer to duraconf's gpg.conf: > > e.g. > > > * we could plausibly take the "algorithm and ciphers" section as-is > > * the no-honor-keyserver-url keyserver-options could be split out > > > Ideally, a diff of our gpg.conf and duraconf's would only show a few > > added/changed lines, for easier auditing and maintenance. What do > > you think? If that includes leaving the comments intact, maybe the attached patch is usable? -- GPG ID: 0x5BF72F42D0952C5A Fingerprint: BD12 65FD 4954 C40A EBCB F5D7 5BF7 2F42 D095 2C5A
from https://github.com/ioerror/duraconf.git --- .../chroot_local-includes/etc/skel/.gnupg/gpg.conf | 93 ++++++++++++++++++++-- 1 file changed, 86 insertions(+), 7 deletions(-) diff --git a/config/chroot_local-includes/etc/skel/.gnupg/gpg.conf b/config/chroot_local-includes/etc/skel/.gnupg/gpg.conf index 38e21b8..20aab6f 100644 --- a/config/chroot_local-includes/etc/skel/.gnupg/gpg.conf +++ b/config/chroot_local-includes/etc/skel/.gnupg/gpg.conf @@ -1,12 +1,91 @@ +# +# This is an implementation of the Riseup OpenPGP Best Practices +# https://help.riseup.net/en/security/message-security/openpgp/best-practices +# https://github.com/ioerror/duraconf.git + + +#----------------------------- +# default key +#----------------------------- + +# The default key to sign with. If this option is not used, the default key is +# the first key found in the secret keyring + +#default-key 0xD8692123C4065DEA5E0F3AB5249B39D24F25E3B6 + + +#----------------------------- +# behavior +#----------------------------- + +# Disable inclusion of the version string in ASCII armored output +no-emit-version + +# Disable comment string in clear text signatures and ASCII armored messages +no-comments + +# Display long key IDs +keyid-format 0xlong + +# List all keys (or the specified ones) along with their fingerprints +with-fingerprint + +# Display the calculated validity of user IDs during key listings +list-options show-uid-validity +verify-options show-uid-validity + +# Try to use the GnuPG-Agent. With this option, GnuPG first tries to connect to +# the agent before it asks for a passphrase. +use-agent + + +#----------------------------- +# keyserver +#----------------------------- + +# This is the server that --recv-keys, --send-keys, and --search-keys will +# communicate with to receive keys from, send keys to, and search for keys on keyserver hkps://hkps.pool.sks-keyservers.net + +# Provide a certificate store to override the system default +# Get this from https://sks-keyservers.net/sks-keyservers.netCA.pem keyserver-options ca-cert-file=/etc/ssl/certs/sks-keyservers.netCA.pem -keyserver-options http-proxy=http://127.0.0.1:8118/ no-honor-keyserver-url -personal-cipher-preferences AES256,AES192,AES,CAST5 -personal-digest-preferences SHA512,SHA384,SHA256 +# Set the proxy to use for HTTP and HKP keyservers - default to the standard +# local Tor socks proxy +# It is encouraged to use Tor for improved anonymity. Preferrably use either a +# dedicated SOCKSPort for GnuPG and/or enable IsolateDestPort and +# IsolateDestAddr +keyserver-options http-proxy=http://127.0.0.1:8118/ +#keyserver-options http-proxy=socks5-hostname://127.0.0.1:9050 + +# Don't leak DNS, see https://trac.torproject.org/projects/tor/ticket/2846 +keyserver-options no-try-dns-srv + +# When using --refresh-keys, if the key in question has a preferred keyserver +# URL, then disable use of that preferred keyserver to refresh the key from +keyserver-options no-honor-keyserver-url + +# When searching for a key with --search-keys, include keys that are marked on +# the keyserver as revoked +keyserver-options include-revoked + + +#----------------------------- +# algorithm and ciphers +#----------------------------- + +# list of personal digest preferences. When multiple digests are supported by +# all recipients, choose the strongest one +personal-cipher-preferences AES256 AES192 AES CAST5 + +# list of personal digest preferences. When multiple ciphers are supported by +# all recipients, choose the strongest one +personal-digest-preferences SHA512 SHA384 SHA256 SHA224 + +# message digest algorithm used when signing a key cert-digest-algo SHA512 -default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed -use-agent -no-auto-key-locate -no-emit-version +# This preference list is used for new keys and becomes the default for +# "setpref" in the edit menu +default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed -- 2.0.1
signature.asc
Description: PGP signature
_______________________________________________ Tails-dev mailing list [email protected] https://mailman.boum.org/listinfo/tails-dev To unsubscribe from this list, send an empty email to [email protected].
