Sequoia PGP is more than just a reimplementation of an existing tool. The team behind it is rethinking tooling for the broader PGP ecosystem. Their innovative ideas are making PGP easier to use. I can’t wait to see Sequoia PGP be more broadly adopted.
Thoughts on To Sign or Not to Sign
39C3, the annual meeting of the Chaos Computer Club (CCC), included a presentation called To sign or not to sign: Practical vulnerabilities in GPG & friends. In their presentation, the security researchers discuss the vulnerabilities that they found in GnuPG, Sequoia, age and minisign. The talk is impressive not the least for the shear number of vulnerabilities (14!) that they found, but also their breadth. They range from buffer overflows, to the use of uninitialized memory, to improper input validation.
In this blog post, I will take a look at the attack that the
researchers claim demonstrates a security weakness in Sequoia, and
consider its possible impact. In my estimation, this characterization
is primarily due to a literal translation of gpg invocations to sq
invocations, and the user ignoring sq’s output. As the user is
following a recipe, a more realistic analysis should have considered a
less naive translation that uses sq’s standard workflows, which
would have prevented the attack. That said, the security researchers
identify an issue that raises legitimate concerns, and the ecosystem
as a whole needs to improve to better protect users.
