mastodon - Link to source

Relax 😎! GPG is not OpenPGP!

Yesterday, vulnerabilities were published gpg.fail but they don't affect #deltachat or other #chatmail clients because

A) We never used #gnupg for anything; we use the modern #rustlang #openpgp implementation @rpgp, security audited multiple times.

B) #openpgp is fine, as modernized in #RFC9580, which already warns against several #gpgfail issues (gpg didn't implement that spec)

Please spread the word that #gpg is not #openpgp ... Thanks! #39c3

gpg.fail

gpg.fail
#gpg #openpgp #RustLang #deltachat #gnupg #chatmail #39c3 #rfc9580 #gpgfail @rPGP
This entry was edited (6 hours ago)
Unknown parent

mastodon - Link to source

Delta Chat (39c3)

@jan once details are published, and #39c3 is over, well take another look. But note that #deltachat's usage of #openpgp is intentionally minimal. #Gpgfail is a lot about failures of signature verification, and parsing problems in the gpg c-implementation but #deltachat doesn't use these mechanisms or code at all. The @rpgp folks are still studying the details, and there might be issues, so maybe also follow them for more details. Again, this doesn't affect deltachat as things stand.
#openpgp #deltachat #39c3 #gpgfail @Jan @rPGP
Unknown parent

mastodon - Link to source

Delta Chat (39c3)

@m yes, rpgp folks are checking this in more detail. It's relatively certain, though, that deltachat's intentionally minimal usage of openpgp (and rpgp) is not touching the problematic code paths and issues identified in gpgfail. Give it a bit of time. There was no upfront disclosure of anything to rpgp folks, and it's Sunday in a see of holidays around, and #39c3 is still ongoing.
#39c3 @m_on_stair
⇧