why do you say coping?

If in 2026 you make generic claims against the feasibility of using #email and #openpgp for secure decentralized messaging, there hardly is a way around taking a deeper look at RFC9850 and RFC9788 and the minimalist Rust-based approach chatmail.at takes. Hammering away at gpg and other crimes of how email-encryption doesnt work well ... frankly does not cut it for making a generic "it can not work" claim. See also chaos.social/@delta/1157966260…

Chatmail

Chatmail provides FOSS infrastructure for interoperable, secure, speedy and reliable end-to-end encrypted messaging. Check out clients as Arcane Chat, Bots or Delta Chat today!

^chatmail.at

Delta Chat

2025-12-28 10:04:51

Relax 😎! GPG is not OpenPGP!

Yesterday, vulnerabilities were published gpg.fail but they don't affect #deltachat or other #chatmail clients because

A) We never used #gnupg for anything; we use the modern #rustlang #openpgp implementation @rpgp, security audited multiple times.

B) #openpgp is fine, as modernized in #RFC9580, which already warns against several #gpgfail issues (gpg didn't implement that spec)

Please spread the word that #gpg is not #openpgp ... Thanks! #39c3

gpg.fail

^gpg.fail

Relax 😎! GPG is not OpenPGP!

Yesterday, vulnerabilities were published gpg.fail but they don't affect #deltachat or other #chatmail clients because

A) We never used #gnupg for anything; we use the modern #rustlang #openpgp implementation @rpgp, security audited multiple times.

B) #openpgp is fine, as modernized in #RFC9580, which already warns against several #gpgfail issues (gpg didn't implement that spec)

Please spread the word that #gpg is not #openpgp ... Thanks! #39c3

The #OpenPGP ecosystem is moving forward with new certificate formats from RFC 9580, as well as upcoming #PQC support via datatracker.ietf.org/doc/draft…

We are working towards support for these modern certificate types on keys.openpgp.org

For this, we need to overhaul and extend our user-facing workflows, as well as the API that KOO exposes. The KOO board has decided to move forward based on the HKPv2 protocol:

datatracker.ietf.org/doc/draft…

🧵 1/2

Post-Quantum Cryptography in OpenPGP

This document defines a post-quantum public-key algorithm extension for the OpenPGP protocol. Given the generally assumed threat of a cryptographically relevant quantum computer, this extension provides a basis for long-term secure OpenPGP signatures…

^{IETF Datatracker}

please note that we use #OpenPGP and not GnuPG/GPG. See en.wikipedia.org/wiki/Pretty_G… for more details.

While exporting private keys is supported, importing private keys is not supported because our security audits don't cover all kinds of key material, but the modern algorithms we chose in collaboration with experts. We only want to support a *subset* of OpenPGP to be able to give similar assurances as Signal about cryptographic security outcomes.

with all due respect and recognition that pgp has a troubled history, pgp twenty years ago and #openpgp now are different things. See for example chaos.social/@delta/1145902670… or
for a more thorough security talk including discussing metadata passthesalt.ubicast.tv/videos/…

Usable end-to-end security with Delta Chat and Chatmail

Over the years, Delta Chat has matured to be an easy-to-use, secure, and even fast decentralized FOSS messenger app for all platforms.

^{Pass the SALT Archives}

Delta Chat

2025-05-29 08:51:53

our friends over at @rpgp just published a monster milestone, humbly tagged 0.16 😍 with

- streaming decryption and encryption

- post-quantum-cryptography

- API streamlining.

#rPGP is a full Rust implementation of #openpgp which counts among the fastest and most compliant implementations today, and includes security audits. Note: #deltachat uses a restricted subset of OpenPGP, and follows best practices (eg using the same ed25519 keys implementation as #signal) github.com/rpgp/rpgp/

GitHub - rpgp/rpgp: OpenPGP implemented in pure Rust, permissively licensed

OpenPGP implemented in pure Rust, permissively licensed - rpgp/rpgp

^GitHub

P… mais ! en plus d'être valide SPF/DKIM/DMARC/ARC les spammeurs signent leurs messages avec #OpenPGP !
#spam #mail

X-Spamd-Result: …
SIGNED_PGP(-2.00)[];
ARC_ALLOW(-1.00)[xxx.xxx:s=dkim:i=1];
DMARC_POLICY_ALLOW(-0.50)[xxx.xxx,quarantine];
R_SPF_ALLOW(-0.20)[+mx];
R_DKIM_ALLOW(-0.20)[xxx.xxx:s=dkim];
MIME_GOOD(-0.20)[multipart/signed,multipart/mixed,text/plain];

Automated digital signing of OS artifacts

lists.archlinux.org/archives/l…

#ArchLinux #Linux #RFC #OpenPGP #DigitalSignature #Automation #Signstar #NetHSM

Comparing #XMPP against #email protocols is too limited. What sets #deltachat apart is *vertical integration* and being driven by UI/UX considerations. Cross-platform Apps and Bots use the Rust core library which connects with #chatmail relays and classic email servers based on a higher level API -- abstracting over SMTP, MIME, #OpenPGP etc. See chatmail.at

#webxdc apps in turn use an even higher level stable API abstracting over email/xmpp/... see webxdc.org/docs/

Chatmail

Chatmail provides FOSS infrastructure for interoperable, secure, speedy and reliable end-to-end encrypted messaging. Check out clients as Arcane Chat, Bots or Delta Chat today!

^chatmail.at

our friends over at @rpgp just published a monster milestone, humbly tagged 0.16 😍 with

- streaming decryption and encryption

- post-quantum-cryptography

- API streamlining.

#rPGP is a full Rust implementation of #openpgp which counts among the fastest and most compliant implementations today, and includes security audits. Note: #deltachat uses a restricted subset of OpenPGP, and follows best practices (eg using the same ed25519 keys implementation as #signal) github.com/rpgp/rpgp/

GitHub - rpgp/rpgp: OpenPGP implemented in pure Rust, permissively licensed

OpenPGP implemented in pure Rust, permissively licensed - rpgp/rpgp

^GitHub

The downside of our project approach was that we often got experts being very dismissive on re-using email and #OpenPGP ... and there still is some opposition which often subsides when actually trying #deltachat and #chatmail, looking at security audits and our strong usable security focus.

There may also be surprising upsides. The UK "Online Safety Bill" which attacks end-to-end encryption integrity seems to not apply for ... e-mail. Because everyone knows, e-mail is unencrypted, right? :)

@libreoffice

The #Libreoffice Youtube channel is posting a lot of interesting talks from the "Libreoffice and #Opensource Conference 2024"

Some of them:

#LuxChat for Governments: youtube.com/watch?v=JXdMKaEXq0…

#OpenDesk on #OpenCode: youtube.com/watch?v=rVhAltODe-…

#Education: youtube.com/watch?v=V4fkWfuFXf…

#Encrypted and #Signed Documents (UI, with #OpenPGP or #x509): youtube.com/watch?v=W-qFr8tL-L…

#Matrix #Luxembourg

Luxchat4Gov

A talk from the LibreOffice and Open Source Conference 2024 in Luxembourg, with Patrick Weber. More details: https://events.documentfoundation.org/libreoffic...

^YouTube

I just released versions 0.6.2 of rsop, a stateless #OpenPGP ("SOP") CLI tool based on @rpgp:

crates.io/crates/rsop/

Changes since rsop 0.6.0:

- decryption based on session keys is now supported,
- generation of man pages and shell tab completion has been added,
- some subtle semantics fixes for component key validity were implemented.

For more on #SOP, see datatracker.ietf.org/doc/draft…

#PGP #GnuPG

Six times so far ... is how often important parts of #deltachat were independently #security audited and analyzed. Thanks to IncludeSecurity, Cure53, Applied Crypto Team at ETH Zuerich and Radical Open Security.

Last audit is from December 2024 covering @rpgp , the minimal #OpenPGP Rust library that is gaining traction with others projects as well.
Shout-out to dignifiedquire and @hko for their excellent maintenance! For more info on Delta Chat related security audits: delta.chat/en/help#security-au…

Delta Chat: FAQ

What is Delta Chat? Delta Chat is a reliable, decentralized and secure messaging app, available for mobile and desktop platforms. Delta Chat feels like Whatsapp or Telegram but you can also use and...

^delta.chat

I just released version 0.1.0 of rsop-oct, a new stateless #OpenPGP ("SOP") CLI tool that focuses exclusively on use with OpenPGP card hardware devices:

crates.io/crates/rsop-oct/0.1.…

Like its sibling project #rsop, rsop-oct is based on @rpgp

In the next release of rsop, OpenPGP card functionality will be removed from it.
The goal is to offer clear UX in two distinct simple CLI tools, as opposed to one combined and confusing CLI tool.

For more on #SOP, see datatracker.ietf.org/doc/draft…

#PGP #GnuPG #SOP

I just released version 0.4.1 of #rsop, a stateless #OpenPGP ("SOP") CLI tool based on @rpgp:

crates.io/crates/rsop/0.4.1

This release adds support for the 'revoke-key' command.

For more on #SOP, see datatracker.ietf.org/doc/draft…

#PGP #GnuPG #StatelessOpenPGP

rPGP is an #OpenPGP implementation in pure #Rust (crates.io/crates/pgp).

It serves as the end-to-end encryption engine for Delta Chat:
@delta, a secure decentralized messager for all major platforms (and then some).

rPGP implements all generations of the OpenPGP standard, up to and including the new RFC 9580.

#RustLang #Cryptography #PGP

New release today: #rPGP version 0.14.0 ✨

(#OpenPGP implemented in pure #Rust, permissively licensed)

github.com/rpgp/rpgp/releases/…

This release brings rather complete support for the excellent new OpenPGP RFC 9580 (also known as "crypto refresh", or "v6")

RFC 9580 standardizes modern cryptographic mechanisms for OpenPGP: AEAD-based encryption, Argon2, and SHA2 fingerprints for the new OpenPGP v6 key format (v4 keys use SHA1).

Thanks @NGIZero for supporting this work!

#RustLang #PGP #GnuPG

some news regarding rPGP, the minimal #Rust #OpenPGP implementation that stably provides end-to-end encryption for Delta users since many years:

- a new FAQ including questions about IETF specs, Post-Quantum cryptography, Autocrypt, LibrePGP, Seqouia etc. github.com/rpgp/rpgp/blob/mast…

- NLNET just granted #OpenPGP V6 work on rPGP: nlnet.nl/project/rPGP-cryptore…

rPGP is an independent and stable project which provides good general #OpenPGP interoperability, see "rpgpie" in tests.sequoia-pgp.org/

rpgp/docs/FAQ.md at master · rpgp/rpgp

OpenPGP implemented in pure Rust, permissively licensed - rpgp/rpgp

^GitHub

I updated my crowd-sourced list of #openpgp, #fido, #u2f and #piv, #pki security tokens:

l.0l.de/tokens

Feel free to have a look if you are in the market for a new security token Contributions and feedback are highly welcome :)

Crypto, FIDO and Security Tokens

Tokens Crypto, FIDO and Security Tokens,How to contribute Please use the Google Sheets comments to discuss or propose changes. Scope:,USB-connected, TFA, PKI, OTP, PIV tokens,Send updates, access requests or inquires to

^{Google Docs}

Can anymany tell me how I'm "supposed" to use end-to-end encryption with XMPP?

As far as I can tell there are three totally different ways to do E2EE:

a)OTR : "[xmpp.org/extensions/xep-0364.h…](Not intended to be a current standard), or technical specification, as better (albeit, newer and less well tested) methods of end-to-end encryption exist for XMPP. "

b)OpenPGP: There are at least two different XEPs about it. XEP-0027 is obsolete, while XEP-0373 is "experimental" but hasn't been updated in almost three years.

c)OMEMO: "Experimental" and hasn't been updated in over two years.

Is there a way to do E2EE in XMPP which is neither deprecated nor experimental? What's the "Current stable" way to do it?

#XMPP #E2EE #EndToEndEncryption #OMEMO #OpenPGP #OTR

In the past few weeks, I spent a bit of time on a set of #OpenPGP hobby projects around #rpgp (github.com/rpgp/rpgp/). Today I'm happy to announce:

rsop v0.1.0 (crates.io/crates/rsop), an early stage "stateless OpenPGP" tool based on rpgp.

Relatedly, I also released rpgpie 🦀️🔐🥧 v0.0.1 (crates.io/crates/rpgpie), an experimental high level OpenPGP API based on rpgp (rsop is built on top of rpgpie).

#PGP #Rust #rustlang

GitHub - rpgp/rpgp: Pure rust implementation of OpenPGP

Pure rust implementation of OpenPGP. Contribute to rpgp/rpgp development by creating an account on GitHub.

^GitHub

News from the machine room: the pure #rust end-to-end encryption engine, "rpgp", saw quite some work and a new release in recent weeks and now @hko released a higher level "rpgpie" interface for application developers ( see fosstodon.org/@hko/11199799800… ) which also powers running the IETF #OpenPGP #interoperability test suite quite successfully .... Delta Chat's security-audited encryption engine is in fact used from several other projects and in other contexts these days and we are happy about it!

Heiko

2024-02-26 13:23:46

In the past few weeks, I spent a bit of time on a set of #OpenPGP hobby projects around #rpgp (github.com/rpgp/rpgp/). Today I'm happy to announce:

rsop v0.1.0 (crates.io/crates/rsop), an early stage "stateless OpenPGP" tool based on rpgp.

Relatedly, I also released rpgpie 🦀️🔐🥧 v0.0.1 (crates.io/crates/rpgpie), an experimental high level OpenPGP API based on rpgp (rsop is built on top of rpgpie).

#PGP #Rust #rustlang

GitHub - rpgp/rpgp: Pure rust implementation of OpenPGP

Pure rust implementation of OpenPGP. Contribute to rpgp/rpgp development by creating an account on GitHub.

^GitHub

Thunderbird is an email client with built-in support for PGP encryption.

Messages are encrypted/decrypted in the client and remain encrypted on email servers, this is client-side encryption.

Some email providers support PGP encryption server-side, this method could be vulnerable to third-party decryption of emails.

PGP: en.wikipedia.org/wiki/Pretty_G…
Client side encryption: en.wikipedia.org/wiki/Client-s…

Website: thunderbird.net
Mastodon: @thunderbird

#Thunderbird #Email #Encryption #OpenPGP #PGP

I gave a talk at #fosdem #fosdem2024.

Video and slides are now available:
fosdem.org/2024/schedule/event…

#thunderbird #security #openpgp #librepgp #smime

I'm interested in your feedback on these thoughts. Either here, or, if your feedback is longer, for a discussion it might be best to post to
thunderbird.topicbox.com/group…

Thanks a lot to the organizers of @fosdem and the modern email developer room.
github.com/modern-email/FOSDEM…

GitHub - modern-email/FOSDEM-24

Contribute to modern-email/FOSDEM-24 development by creating an account on GitHub.

^GitHub

Having decidedly too much fun playing with ancient #PGP artifacts.

Note the two version 2 public keys from 1992. They were created just over a year after Phil Zimmermann first released PGP (on 6 June 1991), deep in the crypto war era.

These keys predate the #OpenPGP name by around half a decade.

At over 31 years old, nation-state actors can definitely factor John Gilmore's RSA 1024 key today.
However, I believe the cost still exceeds a hobbyist budget even now.

We have just issued the first #release of #sshd-openpgp-auth and #ssh-openpgp-auth.

Using this server and client-side tooling it is possible to manage the #authentication of #SSH host keys with the help of an #OpenPGP certificate as trust anchor.

crates.io/crates/sshd-openpgp-…

crates.io/crates/ssh-openpgp-a…

Many thanks to @wiktor for the great collaboration and #NLnet / #NGIAssure for funding this work!

#DNS #KeyOxide #KnownHosts #OpenSSH #Rustlang #Software #WebKeyDirectory #WebOfTrust #WKD #WoT

(New blog) The State of the Keyservers in 2024

“In the two and a half years since the sks-keyservers.net shutdown in June 2021, the concept of #OpenPGP #keyservers has been called into question. However, keyservers still provide a vital service to the OpenPGP ecosystem.
…
OpenPGP is one of only two widely-used cryptography standards to include a full Public Key Infrastructure”

blog.pgpkeys.eu/state-keyserve…

Better to take some more time to prepare a proper release – looking forward to it and kudos for keeping Thunderbird on @fdroidorg.

Still, any news about future encryption options, especially via #OpenPGP? Pretty much all #Android email clients rely on #Openkeychain to manage all your keys. Sadly it is still unmaintained and desperately needs a replacement or someone to take over development. Look at issues like this: github.com/open-keychain/open-…
#Thunderbird for Android will also rely on this unmaintained app.

Vulnerability in OpenKeychain · Issue #2856 · open-keychain/open-keychain

Hello, Researchers discovered a vulnerability in OpenKeychain. The technical report was sent by email (security@openkeychain.org), no response. Please contact us.

^GitHub

LibreOffice supports symmetric and asymmetric encryption for OpenDocument Format (ODF) files.

Select File > Save/Save As

The "Save with password" option encrypts the file with AES-256.
The "Encrypt with GPG key" option encrypts the file with a public key.

Symmetric encryption: en.wikipedia.org/wiki/Symmetri…
Asymmetric encryption: en.wikipedia.org/wiki/Public-k…

Website: libreoffice.org
Mastodon: @libreoffice

#LibreOffice #Encryption #OpenSource #OpenPGP #PGP #GnuPG #GPG #InfoSec #Privacy #Security