Relax 😎! GPG is not OpenPGP!
Yesterday, vulnerabilities were published gpg.fail but they don't affect #deltachat or other #chatmail clients because
A) We never used #gnupg for anything; we use the modern #rustlang #openpgp implementation @rpgp, security audited multiple times.
B) #openpgp is fine, as modernized in #RFC9580, which already warns against several #gpgfail issues (gpg didn't implement that spec)
Please spread the word that #gpg is not #openpgp ... Thanks! #39c3


Sandro
in reply to Delta Chat (39c3) • • •Delta Chat (39c3)
in reply to Sandro • • •Sandro
in reply to Delta Chat (39c3) • • •yeah, I know, but if opengpg is not vulnerable what other software are they then referring to? 😅😅😅
How was that proprietary version called? PGP?
Delta Chat (39c3)
in reply to Sandro • • •caravantravellers 🌈
in reply to Delta Chat (39c3) • • •SnowBlind2005
in reply to Delta Chat (39c3) • • •This is all being presented in extremely confusing manner.
If anyone is confused, multiple vulnerabilities were found in GPG. The author ignored them for several months, then posted a gas lighting message not to use a certain function instead of patching it. Get ready for the book length gas lighting response of all the other issues that were found.
Delta Chat (39c3)
in reply to SnowBlind2005 • • •🌱🏴🅰️🏳️⚧️🐧📎 Ambiyelp
in reply to Delta Chat (39c3) • • •Are you seeing distros or the gnuprojecct applying this patch?
#Security #GPG #GNUProject
Delta Chat (39c3)
in reply to 🌱🏴🅰️🏳️⚧️🐧📎 Ambiyelp • • •Rebel Zhang
in reply to Delta Chat (39c3) • • •m_on_stair
in reply to Delta Chat (39c3) • • •Delta Chat (39c3)
in reply to m_on_stair • • •Jan
in reply to Delta Chat (39c3) • • •Thanks for the pro-active reach out. Really appreciated.
I find "security audited multiple times" not very reassuring though, heard it to many times already...
Can you go a bit into detail why you think Deltachat (or its underlying library) is safe against the mentioned gpg.fail attacks?
Delta Chat (39c3)
in reply to Jan • • •DD9JN
in reply to Delta Chat (39c3) • • •Hi,
For those interested we have a master ticket dev.gnupg.org/T7900 which lists all the claimed bugs. Actually there is only one major bug (T7906 - armor parser) which was fixed early November. T7901 requires a 2nd pre-image attack on SHA1- which does nor yet exist. T7907 (plaintext recovery) is simply untrue; see dev.gnupg.org/T7907#210501
BTW, of course we sign our commits and most of us even use hardware tokens.
- wk@gnupg.org
Login
dev.gnupg.org