From franciskp19 at gmail.com  Fri Apr  1 05:13:51 2022
From: franciskp19 at gmail.com (Francis Kp)
Date: Fri, 1 Apr 2022 08:43:51 +0530
Subject: Help with "config.h file not found error" on Gnupg version 1.4.13
In-Reply-To: <13314e18-21a0-9531-e539-2ebc9f0174e3@sixdemonbag.org>
References: <CAHP56Jwd8Vi_AgcPOkvSTy0eo9LoP5SpL=0zWL=ukV3C3f0zhw@mail.gmail.com>
 <13314e18-21a0-9531-e539-2ebc9f0174e3@sixdemonbag.org>
Message-ID: <CAHP56Jymt+q=qpZ=p4X7=rjEEXgC+PDdYpiRH0OQz0rNMzH6Sg@mail.gmail.com>

First of all, thank you for taking your time to reply to this email. I
tried it using the -l flag. The config file was found in the directory
before that. Below is the command I executed.

$ gcc -I /home/user/Desktop/gnupg-1.4.13
-l/home/user/Desktop/gnupg-1.4.13 mpi-pow.c

Now it's throwing the below error

>In file included from mpi-pow.c:32:
>mpi-internal.h:32:10: fatal error: mpi.h: No such file or directory
>   32 | #include "mpi.h"
>      |          ^~~~~~~
>compilation terminated.

I tried copying the header file mpi.h into the directory gnupg-1.4.13
and compiling the mpi-pow.c program, now the error is like given
below:

>In file included from mpi-internal.h:32,
>                 from mpi-pow.c:32:
>mpi.h:34:10: fatal error: iobuf.h: No such file or directory
>   34 | #include "iobuf.h"
>      |          ^~~~~~~~~

Is there anything wrong with the way I used the -l flag ? If so could
anyone guide me in the right direction?

On Wed, 30 Mar 2022 at 21:19, Robert J. Hansen via Gnupg-users
<gnupg-users at gnupg.org> wrote:
>
> You will have much better luck if you send only plain-text emails to
> this list.  Some of the people you'd really like to see your email
> refuse to read HTML email, on the grounds that it's a security risk.
> I've quoted your entire message below as plaintext to help you reach
> these people.
>
> To resolve your problem I'd suggest finding where the Automake-created
> config.h header file lies, and including that directory in your GCC
> invocation by using the -I flag.
>
> Hope this helps.  :)
>
> On 3/30/2022 1:21 AM, Francis Kp via Gnupg-users wrote:
> > Hi all,
> > As in exercise in understanding Cybersecurity in IoT better, I'm trying
> > to implement the flush-reload attack from the paper "FLUSH+RELOAD: A
> > High Resolution, Low Noise, L3 Cache Side-Channel Attack". The crux of
> > the attack is to extract the private key of RSA encryption used in
> > Gnupg. One of the steps to initiate the attack is to find certain memory
> > addresses to feed to a spy function. For that I'm trying to open a C
> > executable in Gnu debugger(gdb). The program is part of the Gnupg 1.4.13
> > version. My aim is to get the memory address of a particular function by
> > setting breakpoint at that line. While compiling the c program using
> > **gcc -g mpi-pow.c**, (And yes I tried without the -g option) I'm
> > getting this error:
> >
> >
> >
> > *mpi-pow.c:28:10: fatal error: config.h: No such file or directory
> >         28 | #include <config.h>
> >            |          ^~~~~~~~~~
> >      compilation terminated*
> >
> >
> >
> > These were the exact steps I did:-->
> >
> >  1.   - Extracted the Gnupg source code using tar xjvf gnupg-1.4.13.tar.bz2
> >  2.   - cd gnupg-1.4.13/
> >  3.   - ./configure
> >  4.   - sudo make
> >  5.   - sudo make install
> >
> >
> > The source code of Gnupg 1.4.13 is at Link_to_code
> > <http://www.ring.gr.jp/pub/net/gnupg/gnupg/>
> > The original paper is here Link_to_paper
> > <https://eprint.iacr.org/2013/448.pdf>
> >
> > A quick google search told me that "In computing, configuration files
> > (commonly known simply as config files) are files used to configure the
> > parameters and initial settings for some computer programs". /And as far
> > as I understood, the config file is made when the "./configure" command
> > is run and in this case, it simply means there is no config.h file in
> > the current directory/. There were no errors during the compilation of
> > Gnupg.
> >
> > I'm using the Intel(R) Core(TM) i5-8250U CPU @ 1.60GHz processor.
> > I tried it on WSL and on Ubuntu 20.04 installed on dual boot.
> >
> >   1. What might be the reason ?
> >   2. How can I rectify this error ?
> >
> > Any help would be highly appreciated.
> >
> > _______________________________________________
> > Gnupg-users mailing list
> > Gnupg-users at gnupg.org
> > https://lists.gnupg.org/mailman/listinfo/gnupg-users
>
> _______________________________________________
> Gnupg-users mailing list
> Gnupg-users at gnupg.org
> https://lists.gnupg.org/mailman/listinfo/gnupg-users


From jcb62281 at gmail.com  Fri Apr  1 06:50:59 2022
From: jcb62281 at gmail.com (Jacob Bachmeyer)
Date: Thu, 31 Mar 2022 23:50:59 -0500
Subject: Help with "config.h file not found error" on Gnupg version 1.4.13
In-Reply-To: <CAHP56Jymt+q=qpZ=p4X7=rjEEXgC+PDdYpiRH0OQz0rNMzH6Sg@mail.gmail.com>
References: <CAHP56Jwd8Vi_AgcPOkvSTy0eo9LoP5SpL=0zWL=ukV3C3f0zhw@mail.gmail.com>
 <13314e18-21a0-9531-e539-2ebc9f0174e3@sixdemonbag.org>
 <CAHP56Jymt+q=qpZ=p4X7=rjEEXgC+PDdYpiRH0OQz0rNMzH6Sg@mail.gmail.com>
Message-ID: <624684B3.1020402@gmail.com>

Francis Kp via Gnupg-users wrote:
> First of all, thank you for taking your time to reply to this email. I
> tried it using the -l flag. The config file was found in the directory
> before that. Below is the command I executed.
>
> $ gcc -I /home/user/Desktop/gnupg-1.4.13
> -l/home/user/Desktop/gnupg-1.4.13 mpi-pow.c
>
> Now it's throwing the below error
>   
> [...]
> I tried copying the header file mpi.h into the directory gnupg-1.4.13
> and compiling the mpi-pow.c program, now the error is like given
> below:
>   
> [...]
> Is there anything wrong with the way I used the -l flag ? If so could
> anyone guide me in the right direction?
>   

Yes, you should remove the copy of mpi.h you made in 
/home/user/Desktop/gnupg-1.4.13; that is not how you make libraries 
available to C compilations.  Try 
-I/home/user/Desktop/gnupg-1.4.13/include instead of copying mpi.h.

If you are having to ask for help with these problems, I am not sure you 
have the prerequisite programming skills to be doing this.  I think you 
need to learn more about C, compilation and linking, and other fairly 
basic computer science topics before trying to study cybersecurity, lest 
you become another entertaining "security" clown who has no clue how 
computers actually work but thinks that signed integers are magically 
more secure.  (Hint:  "signed" and "unsigned" in C have nothing to do 
with cryptographic signatures whatsoever.)


-- Jacob


From rjh at sixdemonbag.org  Fri Apr  1 15:23:35 2022
From: rjh at sixdemonbag.org (Robert J. Hansen)
Date: Fri, 1 Apr 2022 09:23:35 -0400
Subject: Help with "config.h file not found error" on Gnupg version 1.4.13
In-Reply-To: <CAHP56Jymt+q=qpZ=p4X7=rjEEXgC+PDdYpiRH0OQz0rNMzH6Sg@mail.gmail.com>
References: <CAHP56Jwd8Vi_AgcPOkvSTy0eo9LoP5SpL=0zWL=ukV3C3f0zhw@mail.gmail.com>
 <13314e18-21a0-9531-e539-2ebc9f0174e3@sixdemonbag.org>
 <CAHP56Jymt+q=qpZ=p4X7=rjEEXgC+PDdYpiRH0OQz0rNMzH6Sg@mail.gmail.com>
Message-ID: <fd953772-e79d-27e9-f883-06da492bcc97@sixdemonbag.org>

> First of all, thank you for taking your time to reply to this email. I
> tried it using the -l flag. The config file was found in the directory
> before that. Below is the command I executed.

I don't want to sound dismissive or discouraging, but you may want to 
consider whether you have the necessary C skills for the task you're 
undertaking.  Learning C development is difficult; learning 
cybersecurity is difficult; doing both at the same time borders on the 
impossible.

> I tried copying the header file mpi.h into the directory gnupg-1.4.13
> and compiling the mpi-pow.c program, now the error is like given
> below:

The easiest way to find all the directories you need to include is to 
take a look at the Autotools build script.  GnuPG was never meant to be 
compiled by hand, file-by-file.  Instead, there's an automated system to 
do it, and you can learn everything you need about how to build an 
individual file by studying this system.  Again, it's something you 
learn in the course of becoming a C developer.

> Is there anything wrong with the way I used the -l flag ? If so could
> anyone guide me in the right direction?

This is a compile-time (include file location) problem, not a link-time 
(library file location) problem.  Again: something discovered in the 
course of becoming a C developer.

Have you considered reaching out to the FLUSH+RELOAD paper authors, to 
see if they have a pre-built binary they might be willing to share with 
you?  It would be a heck of a lot faster than learning enough C to 
implement your own FLUSH+RELOAD on GnuPG.


From vishal.rana118 at gmail.com  Mon Apr  4 07:52:13 2022
From: vishal.rana118 at gmail.com (Vishal Rana)
Date: Mon, 4 Apr 2022 11:22:13 +0530
Subject: Regarding FIPs setup
Message-ID: <CAFhV5OeeF7+xoU-Cnt2Hw+XV2woRMug6UNs8T0_gsBWL7a9gNg@mail.gmail.com>

Hello Team,

I am working on gnuPG(Libgcrypt) feasibility study for my project.
Where I need security mode FIPs 140-2 to enable.

On the signing server side I have enabled Fips 140-2 by adding an
environment
variable.

I want to know that on the other side (on other machines) where we want to
verify digital signature there also we need to configure libgcrypt in FIPs
mode or
its optional.

Please suggest.
-- 




*Thanks & Regards,Vishal RanaMobile :09422123401*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20220404/424f0e9c/attachment.html>

From guru at unixarea.de  Tue Apr  5 16:57:00 2022
From: guru at unixarea.de (Matthias Apitz)
Date: Tue, 5 Apr 2022 16:57:00 +0200
Subject: using OpenPGP card to unlock a LUKS device on boot
Message-ID: <YkxYvESCVp61L/gE@c720-r368166>


Hello,

Can someone please comment in the forum or here (and I copy it over) how
an OpenPGP card could be used to unlock a ciphered LUKS partition during
boot of the L5 mobile device, see this posting at the end:

https://forums.puri.sm/t/librem-5-unlock-luks-volume-with-a-fido2-device/16890/7

Werner, what about your L5?

Thanks

	matthias
-- 
Matthias Apitz, ? guru at unixarea.de, http://www.unixarea.de/ +49-176-38902045
Public GnuPG key: http://www.unixarea.de/key.pub

Peace instead of NATO!  ??? ?????? ????!  Frieden statt NATO! ?Paz en vez de OTAN!


From vishal.rana118 at gmail.com  Wed Apr  6 07:17:07 2022
From: vishal.rana118 at gmail.com (Vishal Rana)
Date: Wed, 6 Apr 2022 10:47:07 +0530
Subject: Digital Signature Verification
Message-ID: <CAFhV5Od5OfvS+ZZVr0o-5T9aUCy4wxEZpvK5+uySn0c+SyTRzQ@mail.gmail.com>

HiTeam,

I am working on image signing and verification.
For feasibility study I have selected gnupg.
*Steps I executed..*
1) made pair of private and public key (RSA4096)
2) I am able to digitally sign an image using "detach". Getting fyl.sig as
output        file.
3) exported the public key using --export -a (ascii armour).


*Step I want to execute  at verification side.. But not aware.*

1) Want to find 'n' and 'e' values from a public key which is imported from
a signed machine. Public key is in ascii armor format.
    want to write my public key in below format.
///////////////////////////////////Copied from
rsa.c///////////////////////////////////////////////////////////////
static const char sample_public_key[] =
" (public-key"
"  (rsa"
"   (n #009F56231A3D82E3E7D613D59D53E9AB921BEF9F08A782AED0B6E46ADBC853EC"
"       7C71C422435A3CD8FA0DB9EFD55CD3295BADC4E8E2E2B94E15AE82866AB8ADE8"
"       7E469FAE76DC3577DE87F1F419C4EB41123DFAF8D16922D5EDBAD6E9076D5A1C"
"       958106F0AE5E2E9193C6B49124C64C2A241C4075D4AF16299EB87A6585BAE917"
"       DEF27FCDD165764D069BC18D16527B29DAAB549F7BBED4A7C6A842D203ED6613"
"       6E2411744E432CD26D940132F25874483DCAEECDFD95744819CBCF1EA810681C"
"       42907EBCB1C7EAFBE75C87EC32C5413EA10476545D3FC7B2ADB1B66B7F200918"
"
664B0E5261C2895AA28B0DE321E921B3F877172CCCAB81F43EF98002916156F6CB#)"
"   (e #010001#)))";
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

But not sure how to decode imported ascii armor public key in above format.
I tried to find in gnupg documents but not able to get information.
Please suggest.

Regards,
Vishal




-- 




*Thanks & Regards,Vishal RanaMobile :09422123401*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20220406/9168f7eb/attachment.html>

From stuartl at longlandclan.id.au  Wed Apr  6 07:35:25 2022
From: stuartl at longlandclan.id.au (Stuart Longland)
Date: Wed, 6 Apr 2022 15:35:25 +1000
Subject: Digital Signature Verification
In-Reply-To: <CAFhV5Od5OfvS+ZZVr0o-5T9aUCy4wxEZpvK5+uySn0c+SyTRzQ@mail.gmail.com>
References: <CAFhV5Od5OfvS+ZZVr0o-5T9aUCy4wxEZpvK5+uySn0c+SyTRzQ@mail.gmail.com>
Message-ID: <20220406153525.673a49bb@longlandclan.id.au>

On Wed, 6 Apr 2022 10:47:07 +0530
Vishal Rana via Gnupg-users <gnupg-users at gnupg.org> wrote:

> But not sure how to decode imported ascii armor public key in above format.
> I tried to find in gnupg documents but not able to get information.
> Please suggest.

https://datatracker.ietf.org/doc/html/rfc4880#section-6.2 describes the
ASCII Armor format.

That whole document should have lots of relevant bits.
-- 
Stuart Longland (aka Redhatter, VK4MSL)

I haven't lost my mind...
  ...it's backed up on a tape somewhere.


From wk at gnupg.org  Wed Apr  6 08:50:17 2022
From: wk at gnupg.org (Werner Koch)
Date: Wed, 06 Apr 2022 08:50:17 +0200
Subject: using OpenPGP card to unlock a LUKS device on boot
In-Reply-To: <YkxYvESCVp61L/gE@c720-r368166> (Matthias Apitz's message of
 "Tue, 5 Apr 2022 16:57:00 +0200")
References: <YkxYvESCVp61L/gE@c720-r368166>
Message-ID: <87czhuogd2.fsf@wheatstone.g10code.de>

On Tue,  5 Apr 2022 16:57, Matthias Apitz said:

> an OpenPGP card could be used to unlock a ciphered LUKS partition during
> boot of the L5 mobile device, see this posting at the end:

No idea, I don't use LUKS but g13 ;-)

> Werner, what about your L5?

It is gathering dust in one of my drawers - frankly no time to to play
with it.  A colleague of mine used it for some time in the home office
but then switched back to an old Fairphone.


Salam-Shalom,

   Werner

-- 
The pioneers of a warless world are the youth that
refuse military service.             - A. Einstein
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20220406/36fa8490/attachment.sig>

From jrf at mailbox.org  Wed Apr  6 10:17:20 2022
From: jrf at mailbox.org (Rainer Fiebig)
Date: Wed, 6 Apr 2022 10:17:20 +0200
Subject: using OpenPGP card to unlock a LUKS device on boot
In-Reply-To: <YkxYvESCVp61L/gE@c720-r368166>
References: <YkxYvESCVp61L/gE@c720-r368166>
Message-ID: <908ed3b6-429d-e268-f8d9-c2391483009c@mailbox.org>

Am 05.04.22 um 16:57 schrieb Matthias Apitz:
> 
> Hello,
> 
> Can someone please comment in the forum or here (and I copy it over) how
> an OpenPGP card could be used to unlock a ciphered LUKS partition during
> boot of the L5 mobile device, see this posting at the end:
> 
> https://forums.puri.sm/t/librem-5-unlock-luks-volume-with-a-fido2-device/16890/7
> 
> Werner, what about your L5?
> 
> Thanks
> 
> 	matthias
> 
Given recent events: can't you spare us your stupid signature? Or
replace "instead" by "through"? Even for die-hard ideologists it's about
time to adapt to reality.


Rainer




From rjh at sixdemonbag.org  Wed Apr  6 16:06:31 2022
From: rjh at sixdemonbag.org (Robert J. Hansen)
Date: Wed, 6 Apr 2022 10:06:31 -0400
Subject: using OpenPGP card to unlock a LUKS device on boot
In-Reply-To: <908ed3b6-429d-e268-f8d9-c2391483009c@mailbox.org>
References: <YkxYvESCVp61L/gE@c720-r368166>
 <908ed3b6-429d-e268-f8d9-c2391483009c@mailbox.org>
Message-ID: <8fe253e5-4fd0-be03-a243-6f8eae35effc@sixdemonbag.org>

> Given recent events: can't you spare us your stupid signature?

Matthias should be, and is, free to advocate for his beliefs in his 
signature.

If we don't stand up for people's right to peacefully say things we 
don't like, we have failed as a community.

I say this as an American who's a fanatical supporter of NATO.  Leave 
the guy alone, and let's get back to discussions about GnuPG.  Thanks.  :)

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 236 bytes
Desc: OpenPGP digital signature
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20220406/342af0a0/attachment.sig>

From jrf at mailbox.org  Wed Apr  6 16:53:44 2022
From: jrf at mailbox.org (Rainer Fiebig)
Date: Wed, 6 Apr 2022 16:53:44 +0200
Subject: using OpenPGP card to unlock a LUKS device on boot
In-Reply-To: <8fe253e5-4fd0-be03-a243-6f8eae35effc@sixdemonbag.org>
References: <YkxYvESCVp61L/gE@c720-r368166>
 <908ed3b6-429d-e268-f8d9-c2391483009c@mailbox.org>
 <8fe253e5-4fd0-be03-a243-6f8eae35effc@sixdemonbag.org>
Message-ID: <84723881-81ab-3b63-7fa6-776b4c443375@mailbox.org>

Am 06.04.22 um 16:06 schrieb Robert J. Hansen via Gnupg-users:
>> Given recent events: can't you spare us your stupid signature?
> 
> Matthias should be, and is, free to advocate for his beliefs in his
> signature.
Just as I am free to comment on a political statement that I find
provocative, blatantly wrong and in the context of current events almost
derisive.

> 
> If we don't stand up for people's right to peacefully say things we
> don't like, we have failed as a community.
Then stand up for *my* right to peacefully say things as well. Or
perhaps just mind your own business.

> 
> I say this as an American who's a fanatical supporter of NATO.? Leave
> the guy alone, and let's get back to discussions about GnuPG.? Thanks.? :)
American or whatever: fanatics are always suspicious to me. Apart from
that: What I do or say is not yours to decide. And I don't need your
advice in this matter. And the OP is probably able to speak for himself.

The signature is a provocative political statement and it therefore has
to be expected and is probably even intended that people react to it.
And so I did. That's all. Like it or not.

Rainer



From rjh at sixdemonbag.org  Wed Apr  6 17:04:24 2022
From: rjh at sixdemonbag.org (Robert J. Hansen)
Date: Wed, 6 Apr 2022 11:04:24 -0400
Subject: using OpenPGP card to unlock a LUKS device on boot
In-Reply-To: <84723881-81ab-3b63-7fa6-776b4c443375@mailbox.org>
References: <YkxYvESCVp61L/gE@c720-r368166>
 <908ed3b6-429d-e268-f8d9-c2391483009c@mailbox.org>
 <8fe253e5-4fd0-be03-a243-6f8eae35effc@sixdemonbag.org>
 <84723881-81ab-3b63-7fa6-776b4c443375@mailbox.org>
Message-ID: <52a25795-830f-d627-2746-8deeb9f0a472@sixdemonbag.org>

> Just as I am free to comment on a political statement that I find
> provocative, blatantly wrong and in the context of current events almost
> derisive.

Excepting that this is not a mailing list for politics.

Matthias has a line in his signature that you object to.  I object to 
it, too, but the only thing we need to do is nothing.  Perhaps you'd 
like to place your own line in your own signature file making your 
pro-NATO feelings clear?  Either way, bringing it to the forefront of 
discussion is incredibly off-topic.

We'd like to keep this mailing list on-topic.  Thanks for understanding.  :)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 236 bytes
Desc: OpenPGP digital signature
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20220406/9533811b/attachment.sig>

From jrf at mailbox.org  Wed Apr  6 17:25:31 2022
From: jrf at mailbox.org (Rainer Fiebig)
Date: Wed, 6 Apr 2022 17:25:31 +0200
Subject: using OpenPGP card to unlock a LUKS device on boot
In-Reply-To: <52a25795-830f-d627-2746-8deeb9f0a472@sixdemonbag.org>
References: <YkxYvESCVp61L/gE@c720-r368166>
 <908ed3b6-429d-e268-f8d9-c2391483009c@mailbox.org>
 <8fe253e5-4fd0-be03-a243-6f8eae35effc@sixdemonbag.org>
 <84723881-81ab-3b63-7fa6-776b4c443375@mailbox.org>
 <52a25795-830f-d627-2746-8deeb9f0a472@sixdemonbag.org>
Message-ID: <225c47e2-6049-2378-360b-9e9c214cf0d8@mailbox.org>

Am 06.04.22 um 17:04 schrieb Robert J. Hansen via Gnupg-users:
>> Just as I am free to comment on a political statement that I find
>> provocative, blatantly wrong and in the context of current events almost
>> derisive.
> 
> Excepting that this is not a mailing list for politics.
You're barking up the wrong tree: It wasn't me who brought politics to
this list.

> 
> Matthias has a line in his signature that you object to.? I object to
> it, too, but the only thing we need to do is nothing.? Perhaps you'd
There are times when "doing nothing" isn't an option any longer. It may
have escaped you but there is a war raging in Europe.

> like to place your own line in your own signature file making your
> pro-NATO feelings clear?? Either way, bringing it to the forefront of
> discussion is incredibly off-topic.
Nonsense. The OP issued a statement, I replied and that could have been
it. It is you who is obviously thriving on extending this discussion.

> 
> We'd like to keep this mailing list on-topic.? Thanks for
> understanding.? :)
Then heed your own advice and simply keep your wisdoms to yourself.

Rainer






From rjh at sixdemonbag.org  Wed Apr  6 18:15:20 2022
From: rjh at sixdemonbag.org (Robert J. Hansen)
Date: Wed, 6 Apr 2022 12:15:20 -0400
Subject: using OpenPGP card to unlock a LUKS device on boot
In-Reply-To: <225c47e2-6049-2378-360b-9e9c214cf0d8@mailbox.org>
References: <YkxYvESCVp61L/gE@c720-r368166>
 <908ed3b6-429d-e268-f8d9-c2391483009c@mailbox.org>
 <8fe253e5-4fd0-be03-a243-6f8eae35effc@sixdemonbag.org>
 <84723881-81ab-3b63-7fa6-776b4c443375@mailbox.org>
 <52a25795-830f-d627-2746-8deeb9f0a472@sixdemonbag.org>
 <225c47e2-6049-2378-360b-9e9c214cf0d8@mailbox.org>
Message-ID: <5ef7b0d8-12d5-0af5-0620-2afd3b53e4a6@sixdemonbag.org>

> You're barking up the wrong tree: It wasn't me who brought politics to
> this list.

You're the one who is turning a single throwaway line in someone's 
signature block into an angry argument.

> Nonsense. The OP issued a statement, I replied and that could have been
> it. It is you who is obviously thriving on extending this discussion.

It "could have been it", I am certain, if he had apologized, removed the 
line from his signature block, and stopped.  Had he done otherwise we'd 
be right where we are now.

Regardless: I think I've made my position clear.  He is under no 
obligation to remove a line from his signature block that you object to 
on purely political grounds.  Let's drop this subject and return to 
talking about GnuPG.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 236 bytes
Desc: OpenPGP digital signature
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20220406/fce534d9/attachment.sig>

From jrf at mailbox.org  Wed Apr  6 18:23:35 2022
From: jrf at mailbox.org (Rainer Fiebig)
Date: Wed, 6 Apr 2022 18:23:35 +0200
Subject: using OpenPGP card to unlock a LUKS device on boot
In-Reply-To: <5ef7b0d8-12d5-0af5-0620-2afd3b53e4a6@sixdemonbag.org>
References: <YkxYvESCVp61L/gE@c720-r368166>
 <908ed3b6-429d-e268-f8d9-c2391483009c@mailbox.org>
 <8fe253e5-4fd0-be03-a243-6f8eae35effc@sixdemonbag.org>
 <84723881-81ab-3b63-7fa6-776b4c443375@mailbox.org>
 <52a25795-830f-d627-2746-8deeb9f0a472@sixdemonbag.org>
 <225c47e2-6049-2378-360b-9e9c214cf0d8@mailbox.org>
 <5ef7b0d8-12d5-0af5-0620-2afd3b53e4a6@sixdemonbag.org>
Message-ID: <ed057803-c1e8-6fc3-e3ad-2283740cf5d9@mailbox.org>

Am 06.04.22 um 18:15 schrieb Robert J. Hansen via Gnupg-users:
>> You're barking up the wrong tree: It wasn't me who brought politics to
>> this list.
> 
> You're the one who is turning a single throwaway line in someone's
> signature block into an angry argument.
No. But you're the one who obviously _must_ have the last word.

> 
>> Nonsense. The OP issued a statement, I replied and that could have been
>> it. It is you who is obviously thriving on extending this discussion.
> 
> It "could have been it", I am certain, if he had apologized, removed the
> line from his signature block, and stopped.? Had he done otherwise we'd
> be right where we are now.
Assumptions are the mother of all disasters.

> 
> Regardless: I think I've made my position clear.? He is under no
> obligation to remove a line from his signature block that you object to
> on purely political grounds.? Let's drop this subject and return to
> talking about GnuPG.
Amen!

Rainer


From vishal.rana118 at gmail.com  Thu Apr  7 11:56:18 2022
From: vishal.rana118 at gmail.com (Vishal Rana)
Date: Thu, 7 Apr 2022 15:26:18 +0530
Subject: Digital Signature Verification
In-Reply-To: <20220406153525.673a49bb@longlandclan.id.au>
References: <CAFhV5Od5OfvS+ZZVr0o-5T9aUCy4wxEZpvK5+uySn0c+SyTRzQ@mail.gmail.com>
 <20220406153525.673a49bb@longlandclan.id.au>
Message-ID: <CAFhV5OcvzHUBPTx1=dK5p4wR7ZRJbFWP_57ZX+ai+aYwe=5G=g@mail.gmail.com>

Thanks Stuart for replying. I am able to decode a public key which is in
ascii armor format. But decoded information is again block of Base64 like
//////////////////////////////////////////////////////////////////////////////////////////
99020D04624C0847011000CED5D5FF24
FAF1052D0254C83FBEA80D956D1F8A08
A3CACCF52DA10BF8465270A889F9A2B0
E61EE71AD239E39FEE37DA24E8CFCEA7
....
......
....... n
//////////////////////////////////////////////////////////////////////////

*From this how to find RSA public key (n,e) values?? not able to relate.*
I want to pass imported public key like below format to API  "*gcry_error_t
gcry_pk_verify (gcry sexp t sig, gcry sexp t data, gcry sexp t pkey*)"
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
static const char sample_public_key[] =
" (public-key"
"  (rsa"
"   (n #009F56231A3D82E3E7D613D59D53E9AB921BEF9F08A782AED0B6E46ADBC853EC"
"       7C71C422435A3CD8FA0DB9EFD55CD3295BADC4E8E2E2B94E15AE82866AB8ADE8"
"       7E469FAE76DC3577DE87F1F419C4EB41123DFAF8D16922D5EDBAD6E9076D5A1C"
"       958106F0AE5E2E9193C6B49124C64C2A241C4075D4AF16299EB87A6585BAE917"
"       DEF27FCDD165764D069BC18D16527B29DAAB549F7BBED4A7C6A842D203ED6613"
"       6E2411744E432CD26D940132F25874483DCAEECDFD95744819CBCF1EA810681C"
"       42907EBCB1C7EAFBE75C87EC32C5413EA10476545D3FC7B2ADB1B66B7F200918"
"
664B0E5261C2895AA28B0DE321E921B3F877172CCCAB81F43EF98002916156F6CB#)"
"   (e #010001#)))";
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

Please suggest to me how to proceed.

Regards,
Vishal Rana



On Wed, Apr 6, 2022 at 11:05 AM Stuart Longland <stuartl at longlandclan.id.au>
wrote:

> On Wed, 6 Apr 2022 10:47:07 +0530
> Vishal Rana via Gnupg-users <gnupg-users at gnupg.org> wrote:
>
> > But not sure how to decode imported ascii armor public key in above
> format.
> > I tried to find in gnupg documents but not able to get information.
> > Please suggest.
>
> https://datatracker.ietf.org/doc/html/rfc4880#section-6.2 describes the
> ASCII Armor format.
>
> That whole document should have lots of relevant bits.
> --
> Stuart Longland (aka Redhatter, VK4MSL)
>
> I haven't lost my mind...
>   ...it's backed up on a tape somewhere.
>


-- 




*Thanks & Regards,Vishal RanaMobile :09422123401*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20220407/6455ddcb/attachment.html>

From wk at gnupg.org  Thu Apr  7 16:13:54 2022
From: wk at gnupg.org (Werner Koch)
Date: Thu, 07 Apr 2022 16:13:54 +0200
Subject: Digital Signature Verification
In-Reply-To: <CAFhV5OcvzHUBPTx1=dK5p4wR7ZRJbFWP_57ZX+ai+aYwe=5G=g@mail.gmail.com>
 (Vishal Rana via Gnupg-users's message of "Thu, 7 Apr 2022 15:26:18
 +0530")
References: <CAFhV5Od5OfvS+ZZVr0o-5T9aUCy4wxEZpvK5+uySn0c+SyTRzQ@mail.gmail.com>
 <20220406153525.673a49bb@longlandclan.id.au>
 <CAFhV5OcvzHUBPTx1=dK5p4wR7ZRJbFWP_57ZX+ai+aYwe=5G=g@mail.gmail.com>
Message-ID: <87y20hkml9.fsf@wheatstone.g10code.de>

On Thu,  7 Apr 2022 15:26, Vishal Rana said:

> Please suggest to me how to proceed.

Most GnuPG tools feature a debug option

--debug mpi
--debug crypto

which shows you lots of debug info. For example the raw RSA parameters.
Use "--debug help" to see all debug classes. But always remember that
these are debug options and the output is not a stable API in any way.


Shalom-Salam,

   Werner


-- 
The pioneers of a warless world are the youth that
refuse military service.             - A. Einstein
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20220407/61e08b71/attachment.sig>

From vishal.rana118 at gmail.com  Fri Apr  8 09:35:32 2022
From: vishal.rana118 at gmail.com (Vishal Rana)
Date: Fri, 8 Apr 2022 13:05:32 +0530
Subject: Digital Signature Verification
In-Reply-To: <87y20hkml9.fsf@wheatstone.g10code.de>
References: <CAFhV5Od5OfvS+ZZVr0o-5T9aUCy4wxEZpvK5+uySn0c+SyTRzQ@mail.gmail.com>
 <20220406153525.673a49bb@longlandclan.id.au>
 <CAFhV5OcvzHUBPTx1=dK5p4wR7ZRJbFWP_57ZX+ai+aYwe=5G=g@mail.gmail.com>
 <87y20hkml9.fsf@wheatstone.g10code.de>
Message-ID: <CAFhV5OeU9_VF=C6P-KMA4QFuVKpf7dqEOuJsiJ6dsN0R82Eoig@mail.gmail.com>

Hi Team,

Thank you Shalom, above suggestion is working.
But Digital signature verify is still not working.

> I am signing image using *gnupg* from server side using "--detach-sign"
and getting *"image.sig*" file.
> Which I am trying to verify on another machine using libgcrypt. On the
verification side I am having "image.bin",image.sig, "PublicKey".
I am applying a hashing func on "image.bin" at the verification side to get
MsgDigest_of_RxMsg.
I am passing arguments to _gcry_pk_verify ( "Rx_image.sig",
MsgDigest_of_RxMsg , Public_key).

Please suggest it to me if I am missing any step. Like any conversion or
decoding is required for "image.sig" before passing it to _gcry_pk_verify
().


Regards,
Vishal Rana.






On Thu, Apr 7, 2022 at 7:44 PM Werner Koch <wk at gnupg.org> wrote:

> On Thu,  7 Apr 2022 15:26, Vishal Rana said:
>
> > Please suggest to me how to proceed.
>
> Most GnuPG tools feature a debug option
>
> --debug mpi
> --debug crypto
>
> which shows you lots of debug info. For example the raw RSA parameters.
> Use "--debug help" to see all debug classes. But always remember that
> these are debug options and the output is not a stable API in any way.
>
>
> Shalom-Salam,
>
>    Werner
>
>
> --
> The pioneers of a warless world are the youth that
> refuse military service.             - A. Einstein
>


-- 




*Thanks & Regards,Vishal RanaMobile :09422123401*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20220408/bbfc4cf3/attachment.html>

From vishal.rana118 at gmail.com  Fri Apr  8 10:37:20 2022
From: vishal.rana118 at gmail.com (Vishal Rana)
Date: Fri, 8 Apr 2022 14:07:20 +0530
Subject: Digital Signature Verification
In-Reply-To: <CAFhV5OeU9_VF=C6P-KMA4QFuVKpf7dqEOuJsiJ6dsN0R82Eoig@mail.gmail.com>
References: <CAFhV5Od5OfvS+ZZVr0o-5T9aUCy4wxEZpvK5+uySn0c+SyTRzQ@mail.gmail.com>
 <20220406153525.673a49bb@longlandclan.id.au>
 <CAFhV5OcvzHUBPTx1=dK5p4wR7ZRJbFWP_57ZX+ai+aYwe=5G=g@mail.gmail.com>
 <87y20hkml9.fsf@wheatstone.g10code.de>
 <CAFhV5OeU9_VF=C6P-KMA4QFuVKpf7dqEOuJsiJ6dsN0R82Eoig@mail.gmail.com>
Message-ID: <CAFhV5OfDC7fHY7GFXTCgcR2hEbXD9NrRt67pKhJPqthu4+4t2w@mail.gmail.com>

Hi Team,

Verify API in libgcrypt is expecting all arguments in * gcry_sexp_t *data type.

gcry_error_t  *gcry_pk_verify (**gcry_sexp_t* sig*, **gcry_sexp_t
*data*, **gcry_sexp_t
*pkey*) .*

  But my received signed image is some unreadable  "--detach-sign" file .
 How I am able to make a received signed image to  * gcry_sexp_t *please
suggest*.*

*Regards,*
*Vishal Rana*

Regards,
Vishal Rana



On Fri, Apr 8, 2022 at 1:05 PM Vishal Rana <vishal.rana118 at gmail.com> wrote:

> Hi Team,
>
> Thank you Shalom, above suggestion is working.
> But Digital signature verify is still not working.
>
> > I am signing image using *gnupg* from server side using "--detach-sign"
> and getting *"image.sig*" file.
> > Which I am trying to verify on another machine using libgcrypt. On the
> verification side I am having "image.bin",image.sig, "PublicKey".
> I am applying a hashing func on "image.bin" at the verification side to
> get MsgDigest_of_RxMsg.
> I am passing arguments to _gcry_pk_verify ( "Rx_image.sig",
> MsgDigest_of_RxMsg , Public_key).
>
> Please suggest it to me if I am missing any step. Like any conversion or
> decoding is required for "image.sig" before passing it to _gcry_pk_verify
> ().
>
>
> Regards,
> Vishal Rana.
>
>
>
>
>
>
> On Thu, Apr 7, 2022 at 7:44 PM Werner Koch <wk at gnupg.org> wrote:
>
>> On Thu,  7 Apr 2022 15:26, Vishal Rana said:
>>
>> > Please suggest to me how to proceed.
>>
>> Most GnuPG tools feature a debug option
>>
>> --debug mpi
>> --debug crypto
>>
>> which shows you lots of debug info. For example the raw RSA parameters.
>> Use "--debug help" to see all debug classes. But always remember that
>> these are debug options and the output is not a stable API in any way.
>>
>>
>> Shalom-Salam,
>>
>>    Werner
>>
>>
>> --
>> The pioneers of a warless world are the youth that
>> refuse military service.             - A. Einstein
>>
>
>
> --
>
>
>
>
> *Thanks & Regards,Vishal RanaMobile :09422123401*
>


-- 




*Thanks & Regards,Vishal RanaMobile :09422123401*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20220408/5e73c0f7/attachment-0001.html>

From wk at gnupg.org  Fri Apr  8 11:02:49 2022
From: wk at gnupg.org (Werner Koch)
Date: Fri, 08 Apr 2022 11:02:49 +0200
Subject: Digital Signature Verification
In-Reply-To: <CAFhV5OfDC7fHY7GFXTCgcR2hEbXD9NrRt67pKhJPqthu4+4t2w@mail.gmail.com>
 (Vishal Rana via Gnupg-users's message of "Fri, 8 Apr 2022 14:07:20
 +0530")
References: <CAFhV5Od5OfvS+ZZVr0o-5T9aUCy4wxEZpvK5+uySn0c+SyTRzQ@mail.gmail.com>
 <20220406153525.673a49bb@longlandclan.id.au>
 <CAFhV5OcvzHUBPTx1=dK5p4wR7ZRJbFWP_57ZX+ai+aYwe=5G=g@mail.gmail.com>
 <87y20hkml9.fsf@wheatstone.g10code.de>
 <CAFhV5OeU9_VF=C6P-KMA4QFuVKpf7dqEOuJsiJ6dsN0R82Eoig@mail.gmail.com>
 <CAFhV5OfDC7fHY7GFXTCgcR2hEbXD9NrRt67pKhJPqthu4+4t2w@mail.gmail.com>
Message-ID: <8735iokkw6.fsf@wheatstone.g10code.de>

On Fri,  8 Apr 2022 14:07, Vishal Rana said:

>   But my received signed image is some unreadable  "--detach-sign" file .
>  How I am able to make a received signed image to  * gcry_sexp_t *please
> suggest*.*

See gnupg/g10/parse-packet.c
and gnupg/g10/pkglue.c

and please do yourself a favor and start with a simpler project than
implementing OpenPGP.


Salam-Shalom,

   Werner


-- 
The pioneers of a warless world are the youth that
refuse military service.             - A. Einstein
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20220408/8d3e8758/attachment.sig>

From felix.mayr at tum.de  Thu Apr 14 23:27:21 2022
From: felix.mayr at tum.de (Felix Mayr)
Date: Thu, 14 Apr 2022 23:27:21 +0200
Subject: --export-filter not working
Message-ID: <d7293753-e919-ecfd-b8c0-e2ff9817530d@tum.de>

Hello all,

so I try to create a file with my public keys and want to exclude some 
authorization keys. `--export-filter` should do the job if I understand 
correctly, but it doesn't work. (platform: Fedora 35/gpg 2.3.4)

Just using the command here to try filter out encryption-keys doesn't 
produce anything usable: 
https://dev.gnupg.org/rG86b64876bef0d8c4be8e309fcf3e2ce21e65a947

Notably, importing the resulting file on another machine, there are no 
subkeys at all (gpg --list-keys)!

Am I doing/understanding something wrong?


Best wishes

Felix


From kloecker at kde.org  Fri Apr 15 16:29:25 2022
From: kloecker at kde.org (Ingo =?ISO-8859-1?Q?Kl=F6cker?=)
Date: Fri, 15 Apr 2022 16:29:25 +0200
Subject: --export-filter not working
In-Reply-To: <d7293753-e919-ecfd-b8c0-e2ff9817530d@tum.de>
References: <d7293753-e919-ecfd-b8c0-e2ff9817530d@tum.de>
Message-ID: <11963922.O9o76ZdvQC@daneel>

On Donnerstag, 14. April 2022 23:27:21 CEST Felix Mayr via Gnupg-users wrote:
> Hello all,
> 
> so I try to create a file with my public keys and want to exclude some
> authorization keys. `--export-filter` should do the job if I understand
> correctly, but it doesn't work. (platform: Fedora 35/gpg 2.3.4)
> 
> Just using the command here to try filter out encryption-keys doesn't
> produce anything usable:
> https://dev.gnupg.org/rG86b64876bef0d8c4be8e309fcf3e2ce21e65a947
> 
> Notably, importing the resulting file on another machine, there are no
> subkeys at all (gpg --list-keys)!
> 
> Am I doing/understanding something wrong?

I have added some debug output. It seems that the result for the usage 
property is always an empty string. I guess either the above commit never 
worked (but the committer surely tested this) or it was broken by a later 
commit. In any case, it's a bug. Please submit a bug report.

Regards,
Ingo
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20220415/c1fb67bc/attachment.sig>

From felix.mayr at tum.de  Sat Apr 16 09:02:54 2022
From: felix.mayr at tum.de (Felix Mayr)
Date: Sat, 16 Apr 2022 09:02:54 +0200
Subject: --export-filter not working
In-Reply-To: <11963922.O9o76ZdvQC@daneel>
References: <d7293753-e919-ecfd-b8c0-e2ff9817530d@tum.de>
 <11963922.O9o76ZdvQC@daneel>
Message-ID: <44910e4d-5e51-df3d-afb0-ebcf41595c4c@tum.de>

Thanks Ingo,

I'll do that (or setup the GPG-code myself to hunt for the bug if 
holidays permit).

Regards,

Felix

Am 15.04.22 um 16:29 schrieb Ingo Kl?cker:
> On Donnerstag, 14. April 2022 23:27:21 CEST Felix Mayr via Gnupg-users wrote:
>> Hello all,
>>
>> so I try to create a file with my public keys and want to exclude some
>> authorization keys. `--export-filter` should do the job if I understand
>> correctly, but it doesn't work. (platform: Fedora 35/gpg 2.3.4)
>>
>> Just using the command here to try filter out encryption-keys doesn't
>> produce anything usable:
>> https://dev.gnupg.org/rG86b64876bef0d8c4be8e309fcf3e2ce21e65a947
>>
>> Notably, importing the resulting file on another machine, there are no
>> subkeys at all (gpg --list-keys)!
>>
>> Am I doing/understanding something wrong?
> 
> I have added some debug output. It seems that the result for the usage
> property is always an empty string. I guess either the above commit never
> worked (but the committer surely tested this) or it was broken by a later
> commit. In any case, it's a bug. Please submit a bug report.
> 
> Regards,
> Ingo
> 
> 
> _______________________________________________
> Gnupg-users mailing list
> Gnupg-users at gnupg.org
> https://lists.gnupg.org/mailman/listinfo/gnupg-users

-- 
Felix Mayr, M.Sc.
research assistant

Technical University of Munich
Department of Electrical and Computer Engineering
Simulation of Nanosystems for Energy Conversion

Arcisstra?e 21
80333 Munich, Germany

email: felix.mayr at tum.de
phone: +49-89-289-26933


From felix.mayr at tum.de  Sat Apr 16 09:10:58 2022
From: felix.mayr at tum.de (Felix Mayr)
Date: Sat, 16 Apr 2022 09:10:58 +0200
Subject: Use multi-usage key in authentication slot on HW-key for encryption
Message-ID: <72a753e5-3e5c-79c8-9f33-b48a23bcec81@tum.de>

So, I decided to use a Yubikey to store my GPG-subkeys. Using the 
smartcard functionality I can store 3 different subkeys and so thought 
that I could actually store some multi-usage key 
(authentication/encryption) there so I can have per-key-encryption for 
private-data (notably passwords with pass). However, while I can use the 
main encrpytion key in "slot 2" just fine, I can't decrypt with the 
"multi"-purpose key stored in the yubikey anymore (yes, I'm using 
--try-all-secrets).

Is this a limitation of the smartcard standard or just an opioniated 
choice in GPG or am I doing something wrong? If it's not possible with 
the smartcard: can I use the PIV-mode of the yubikey for that purpose?


Regards,

Felix


From kloecker at kde.org  Sat Apr 16 12:44:46 2022
From: kloecker at kde.org (Ingo =?ISO-8859-1?Q?Kl=F6cker?=)
Date: Sat, 16 Apr 2022 12:44:46 +0200
Subject: Use multi-usage key in authentication slot on HW-key for
 encryption
In-Reply-To: <72a753e5-3e5c-79c8-9f33-b48a23bcec81@tum.de>
References: <72a753e5-3e5c-79c8-9f33-b48a23bcec81@tum.de>
Message-ID: <5817563.lOV4Wx5bFT@daneel>

On Samstag, 16. April 2022 09:10:58 CEST Felix Mayr via Gnupg-users wrote:
> So, I decided to use a Yubikey to store my GPG-subkeys. Using the
> smartcard functionality I can store 3 different subkeys and so thought
> that I could actually store some multi-usage key
> (authentication/encryption) there so I can have per-key-encryption for
> private-data (notably passwords with pass). However, while I can use the
> main encrpytion key in "slot 2" just fine, I can't decrypt with the
> "multi"-purpose key stored in the yubikey anymore (yes, I'm using
> --try-all-secrets).
> 
> Is this a limitation of the smartcard standard or just an opioniated
> choice in GPG or am I doing something wrong? If it's not possible with
> the smartcard: can I use the PIV-mode of the yubikey for that purpose?

The OpenPGP card standard offers three slots. Each slot is single usage. The 
key in the first slot is used for signing (data and keys) exclusively, the key 
in the second slot is used for encryption exclusively, and the key in the 
third slot is used for authentication (i.e. with ssh) exclusively.

If your Yubikey supports PIV then you can store more keys with PIV. You need 
GnuPG 2.3 for full multi-card and multi-card-app (e.g. OpenPGP _and_ PIV) 
support.

Regards,
Ingo
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20220416/2bd0ad39/attachment.sig>

From felix.mayr at tum.de  Sat Apr 16 13:10:06 2022
From: felix.mayr at tum.de (Felix Mayr)
Date: Sat, 16 Apr 2022 13:10:06 +0200
Subject: Use multi-usage key in authentication slot on HW-key for
 encryption
In-Reply-To: <5817563.lOV4Wx5bFT@daneel>
References: <72a753e5-3e5c-79c8-9f33-b48a23bcec81@tum.de>
 <5817563.lOV4Wx5bFT@daneel>
Message-ID: <4031f4ef-ce59-01f6-6571-97c59bf94084@tum.de>

> The OpenPGP card standard offers three slots. Each slot is single usage. The
> key in the first slot is used for signing (data and keys) exclusively, the key
> in the second slot is used for encryption exclusively, and the key in the
> third slot is used for authentication (i.e. with ssh) exclusively.
Well, and I reckon this is relatively hardcoded into GnuPG?

> If your Yubikey supports PIV then you can store more keys with PIV. You need
> GnuPG 2.3 for full multi-card and multi-card-app (e.g. OpenPGP _and_ PIV)
> support.
That sounds great! Is there any documentation on how to use both the PGP 
and PIV-card simultaneously?

Regards,

Felix


From felix.mayr at tum.de  Sat Apr 16 18:14:02 2022
From: felix.mayr at tum.de (Felix Mayr)
Date: Sat, 16 Apr 2022 18:14:02 +0200
Subject: Use multi-usage key in authentication slot on HW-key for
 encryption
In-Reply-To: <4031f4ef-ce59-01f6-6571-97c59bf94084@tum.de>
References: <72a753e5-3e5c-79c8-9f33-b48a23bcec81@tum.de>
 <5817563.lOV4Wx5bFT@daneel> <4031f4ef-ce59-01f6-6571-97c59bf94084@tum.de>
Message-ID: <392db18a-abe5-fac2-9d65-b9b93dbc90c4@tum.de>

>> If your Yubikey supports PIV then you can store more keys with PIV. 
>> You need
>> GnuPG 2.3 for full multi-card and multi-card-app (e.g. OpenPGP _and_ PIV)
>> support.
> That sounds great! Is there any documentation on how to use both the PGP 
> and PIV-card simultaneously?

So, it looks like it picks up both automatically and it works seamlessly 
- only thing missing now is how to push EEC-P 384 keys onto the device 
(so that I can keep a backup, sadly only 2048bit RSA and ECC-P 384 is 
supported in the PIV-slots). Still looks very nice for now. I hope the 
next email will be signed ;)!

Regards

Felix


From patrick at enigmail.net  Mon Apr 18 11:43:24 2022
From: patrick at enigmail.net (Patrick Brunschwig)
Date: Mon, 18 Apr 2022 11:43:24 +0200
Subject: Invitation to the 6th OpenPGP Email Summit
Message-ID: <4d0650c8-55da-1099-1f88-05fe1bff520a@enigmail.net>

I'm happy to announce the 6th OpenPGP Email Summit which will take place

        Friday, May 27 & Saturday, May 28, 2022
  in Geneva (Switzerland) at the offices of Proton AG
     (the company behind ProtonMail and OpenPGP.js)

For those who are interested in chatting, hacking or starting
discussions prior to the "real" summit, there is the option to already
meet on Thursday, May 26.

REGISTRATION
============

If you want to attend, please add yourself to the following cryptpad:
https://cryptpad.fr/pad/#/2/pad/edit/EtMIfWF2q6qP+c3iv8qNH+x0/

If you need funding for your travel/hotel expenses, then please get
in contact with me.


ABOUT THE OpenPGP EMAIL SUMMIT
==============================

This is an event open for anybody involved in the development of email
clients using OpenPGP for encryption, and related software.

We already had 5 OpenPGP Email Summits at various locations in Europe.
These are meetings by technical experts of projects and tools dealing
with OpenPGP with a focus on email encryption. The goals are to better
get to know each other, and to discuss and work on several technical
issues that hopefully improve certain aspects of OpenPGP-based email
encryption. For details, see
  https://wiki.gnupg.org/OpenPGPEmailSummits



NOTES
=====
This is a meeting of those who develop software. Thus, we will have a
lot of tech talk about key servers, key exchange, subject encryption,
password recovery, etc.

Thus, feel free to join us if you are working in the area of
- TECHNICAL DETAILS
- for SENDING or PROCESSING ENCRYPTED EMAILS
- with OpenPGP
- in a project or product.

Note that this is neither a well-organized conference nor a commercial
meeting. The agenda will be driven by the attendees. Anyone may propose
any topic for discussion, as long as he/she is ready to lead the discussion.

More details are available on the web site:
https://wiki.gnupg.org/OpenPGPEmailSummit202205


Looking forward to meeting you in Geneva
-Patrick


-- 
Patrick Brunschwig
mailto:patrick at enigmail.net
PGP fingerprint: 4F9F 89F5 505A C1D1 A260 631C DB11 87B9 DD5F 693B

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 834 bytes
Desc: OpenPGP digital signature
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20220418/701832cc/attachment.sig>

From vishal.rana118 at gmail.com  Tue Apr 19 12:22:43 2022
From: vishal.rana118 at gmail.com (Vishal Rana)
Date: Tue, 19 Apr 2022 15:52:43 +0530
Subject: Digital Signature Verification
In-Reply-To: <8735iokkw6.fsf@wheatstone.g10code.de>
References: <CAFhV5Od5OfvS+ZZVr0o-5T9aUCy4wxEZpvK5+uySn0c+SyTRzQ@mail.gmail.com>
 <20220406153525.673a49bb@longlandclan.id.au>
 <CAFhV5OcvzHUBPTx1=dK5p4wR7ZRJbFWP_57ZX+ai+aYwe=5G=g@mail.gmail.com>
 <87y20hkml9.fsf@wheatstone.g10code.de>
 <CAFhV5OeU9_VF=C6P-KMA4QFuVKpf7dqEOuJsiJ6dsN0R82Eoig@mail.gmail.com>
 <CAFhV5OfDC7fHY7GFXTCgcR2hEbXD9NrRt67pKhJPqthu4+4t2w@mail.gmail.com>
 <8735iokkw6.fsf@wheatstone.g10code.de>
Message-ID: <CAFhV5Oe9nQ6OFMS-oT3aDn_U+3LoGv16Dh9hv=5hN+xdTjoYVA@mail.gmail.com>

Hi Team,

Digital signature verification is failing. Getting "*Bad signature*" error.
How to debug this??

Having some observations.
*scenario 1*: Using 2 machines.
1 for signing message file. using  ($ gpg --version gpg (GnuPG) 2.2.19
libgcrypt 1.8.5 ).
another machine  for sign verification with (libgcrypt 1.8.5.)
Getting "*Bad signature*" error  for *gcry_pk_verify (**gcry_sexp_t* sig*, *
*gcry_sexp_t *data*, **gcry_sexp_t *pkey*) .*

*scenario 2:* Using 1 machine only for signing and verification  with
(libgcrypt 1.8.5.).
Getting "* Signature Verified*".  Success.

In both scenario's I am using the same "message file", same set of RSA
"private/public keys" and same sha512 hash.
But observation is generated signature,"image.sig" files on both scenarios
are different. means hexdump for image.sig in both scenario is different.

Please suggest how to test or debug this.

Regards,
Vishal Rana.

On Fri, Apr 8, 2022 at 2:34 PM Werner Koch <wk at gnupg.org> wrote:

> On Fri,  8 Apr 2022 14:07, Vishal Rana said:
>
> >   But my received signed image is some unreadable  "--detach-sign" file .
> >  How I am able to make a received signed image to  * gcry_sexp_t *please
> > suggest*.*
>
> See gnupg/g10/parse-packet.c
> and gnupg/g10/pkglue.c
>
> and please do yourself a favor and start with a simpler project than
> implementing OpenPGP.
>
>
> Salam-Shalom,
>
>    Werner
>
>
> --
> The pioneers of a warless world are the youth that
> refuse military service.             - A. Einstein
>


-- 




*Thanks & Regards,Vishal RanaMobile :09422123401*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20220419/4d2615fd/attachment.html>

From wk at gnupg.org  Thu Apr 21 18:15:50 2022
From: wk at gnupg.org (Werner Koch)
Date: Thu, 21 Apr 2022 18:15:50 +0200
Subject: [Announce] GnuPG 2.3.5 released
Message-ID: <87o80ubefd.fsf@wheatstone.g10code.de>

Hello!

We are pleased to announce the availability of a new GnuPG release:
version 2.3.5.  This is another release in the stable 2.3 series which
introduces new options, improves the performance, and fixes some bugs.
See below for details.


What is GnuPG
=============

The GNU Privacy Guard (GnuPG, GPG) is a complete and free implementation
of the OpenPGP and S/MIME standards.

GnuPG allows to encrypt and sign data and communication, features a
versatile key management system as well as access modules for public key
directories.  GnuPG itself is a command line tool with features for easy
integration with other applications.  The separate library GPGME provides
a uniform API to use the GnuPG engine by software written in common
programming languages.  A wealth of frontend applications and libraries
making use of GnuPG are available.  As an universal crypto engine GnuPG
provides support for S/MIME and Secure Shell in addition to OpenPGP.

GnuPG is Free Software (meaning that it respects your freedom).  It can
be freely used, modified and distributed under the terms of the GNU
General Public License.

Three different series of GnuPG are actively maintained:

- Version 2.3 is the current stable version with a lot of new features
  compared to 2.2.  This announcement is about the latest release of
  this series.

- Version 2.2 is our LTS (long term support) version and guaranteed to
  be maintained at least until the end of 2024.
  See https://gnupg.org/download/index.html#end-of-life

- Version 1.4 is only maintained to allow decryption of very old data
  which is, for security reasons, not anymore possible with other GnuPG
  versions.


Noteworthy changes in version 2.3.5 (2022-04-21)
================================================

  * gpg: Up to five times faster verification of detached signatures.
    Doubled detached signing speed.  [T5826,rG4e27b9defc,rGf8943ce098]

  * gpg: Threefold decryption speedup for large files.
    [T5820,rGab177eed51]

  * gpg: Nearly double the AES256.OCB encryption speed.  [rG99e2c178c7]

  * gpg: Removed EAX from the preference list.  [rG253fcb9777]

  * gpg: Allow --dearmor to decode all kinds of armor files.
    [rG34ea19aff9]

  * gpg: Remove restrictions for the name part of a user-id.
    [rG8945f1aedf]

  * gpg: Allow decryption of symmetric encrypted data even for
    non-compliant cipher.  [rG8631d4cfe2]

  * gpg,gpgsm: New option --require-compliance.  [rGee013c5350]

  * gpgsm: New option --ignore-cert-with-oid.  [rGe23dc755fa]

  * gpgtar: Create and handle extended headers to support long file
    names.  [T5754]

  * gpgtar: Support file names longer than MAX_PATH on Windows.
    [rG70b738f93f]

  * gpgtar: Use a pipe for decryption and thus avoid memory
    exhaustion.  [rGe5ef5e3b91]

  * gpgtar: New option --with-log.  [rGed53d41b4c]

  * agent: New flag "qual" for the trustlist.txt.  [rG7c8c606061]

  * scdaemon: Add support for GeNUA cards.  [rG0dcc249852]

  * scdaemon: Add --challenge-response option to PK_AUTH for OpenPGP
    cards.  [T5862]

  * dirmngr: Support the use of ECDSA for CRLs and OCSP.
    [rGde87c8e1ea,rG890e9849b5]

  * dirmngr: Map all gnupg.net addresses to the Ubuntu keyserver.
    [T5751]

  * ssh: Return a faked response for the new session-bind extension.
    [T5931]

  * gpgconf: Add command aliases -L -K -R.  [rGec4a1cffb8]

  * gpg: Request keygrip of key to add via command interface.  [T5771]

  * gpg: Print Yubikey version correctly.  [T5787]

  * gpg: Always use version >= 4 to generate key signature.  [T5809]

  * gpg: Fix generating AEAD packet.  [T5853]

  * gpg: Fix version on symmetric encrypted AEAD files if the force
    option is used.  [T5856]

  * gpg: Fix adding the list of ultimate trusted keys.  [T5742]

  * gpgsm: Fix parsing of certain PKCS#12 files.  [T5793]

  * gpgsm: Print diagnostic about CRL problems due to Tor mode.
    [rG137e59a6a5]

  * agent: Use "Created:" field for creation time.  [T5538]

  * scdaemon Fix error handling for a PC/SC reader selected with
    reader-port.  [T5758]

  * scdaemon: Fix DEVINFO with no --watch.  [rGc6dd9ff929]

  * scdaemon: Fix socket resource leak on Windwos.  [T5029]

  * scdaemon: Use extended mode for pkcs#15 already for rsa2048.
    [rG597253ca17]

  * scdaemon: Enhance PASSWD command to accept KEYGRIP optionally.
    [T5862]

  * scdaemon: Fix memory leak in ccid-driver.  [rG8ac92f0e80]

  * tpm: Always use hexgrip when storing a key password.
    [rGaf2fbd9b01]

  * dirmngr: Make WKD lookups work for resolvers not handling SRV
    records.  [T4729]

  * dirmngr: Avoid initial delay on the first keyserver access in
    presence of --no-use-tor.  [rG57d546674d]

  * dirmngr: Workaround for a certain broken LDAP URL.  [rG90caa7ad59]

  * dirmngr: Escape more characters in WKD requests.  [T5902]

  * dirmngr: Suppress error message on trial reading as PEM format.
    [T5531]

  * gpgconf: Fix component table when not building without TPM
    support.  [T5701]

  * gpgconf: Silence warnings from parsing the option files.  [T5874]

  * gpgconf: Do not list ignored options and mark forced options as
    read-only.  [rG42785d7c8a]

  * gpgconf: Tweak the use of the ldapserver option.  [T5801]

  * ssh: Fix adding an ed25519 key with a zero length comment.  [T5794]

  * kbx: Fix searching for FPR20 in version 2 blob.  [T5888]

  * Fix early homedir creation.  [T5895]

  * Improve removing of stale lockfiles under Unix.  [T5884]

  Release-info: https://dev.gnupg.org/T5743
  

Getting the Software
====================

Please follow the instructions found at <https://gnupg.org/download/> or
read on:

GnuPG may be downloaded from one of the GnuPG mirror sites or direct
from its primary FTP server.  The list of mirrors can be found at
<https://gnupg.org/download/mirrors.html>.  Note that GnuPG is not
available at ftp.gnu.org.

The GnuPG source code compressed using BZIP2 and its OpenPGP signature
are available here:

 https://gnupg.org/ftp/gcrypt/gnupg/gnupg-2.3.5.tar.bz2 (7423k)
 https://gnupg.org/ftp/gcrypt/gnupg/gnupg-2.3.5.tar.bz2.sig

An installer for Windows without any graphical frontend except for a
very minimal Pinentry tool is available here:

 https://gnupg.org/ftp/gcrypt/binary/gnupg-w32-2.3.5_20210421.exe (4717k)
 https://gnupg.org/ftp/gcrypt/binary/gnupg-w32-2.3.5_20210421.exe.sig

The source used to build the Windows installer can be found in the same
directory with a ".tar.xz" suffix.


Checking the Integrity
======================

In order to check that the version of GnuPG which you are going to
install is an original and unmodified one, you can do it in one of
the following ways:

 * If you already have a version of GnuPG installed, you can simply
   verify the supplied signature.  For example to verify the signature
   of the file gnupg-2.3.5.tar.bz2 you would use this command:

     gpg --verify gnupg-2.3.5.tar.bz2.sig gnupg-2.3.5.tar.bz2

   This checks whether the signature file matches the source file.
   You should see a message indicating that the signature is good and
   made by one or more of the release signing keys.  Make sure that
   this is a valid key, either by matching the shown fingerprint
   against a trustworthy list of valid release signing keys or by
   checking that the key has been signed by trustworthy other keys.
   See the end of this mail for information on the signing keys.

 * If you are not able to use an existing version of GnuPG, you have
   to verify the SHA-1 checksum.  On Unix systems the command to do
   this is either "sha1sum" or "shasum".  Assuming you downloaded the
   file gnupg-2.3.5.tar.bz2, you run the command like this:

     sha1sum gnupg-2.3.5.tar.bz2

   and check that the output matches the next line:

0b9f3dc3cb5972844a18fc9b692730e53ffd55a5  gnupg-2.3.5.tar.bz2
3c020bce4e8b6da69e3a31d6fc3745a8c2263319  gnupg-w32-2.3.5_20220421.tar.xz
ad98967bde94ef57b55d60d167d884bcea3e65d6  gnupg-w32-2.3.5_20220421.exe


Internationalization
====================

This version of GnuPG has support for 26 languages with Chinese
(traditional and simplified), Czech, French, German, Italian,
Japanese, Norwegian, Polish, Russian, and Ukrainian being almost
completely translated.


Documentation and Support
=========================

The file gnupg.info has the complete reference manual of the system.
Separate man pages are included as well but they miss some of the
details available only in the manual.  The manual is also available
online at

  https://gnupg.org/documentation/manuals/gnupg/

or can be downloaded as PDF at

  https://gnupg.org/documentation/manuals/gnupg.pdf

You may also want to search the GnuPG mailing list archives or ask on
the gnupg-users mailing list for advise on how to solve problems.  Most
of the new features are around for several years and thus enough public
experience is available.  https://wiki.gnupg.org has user contributed
information around GnuPG and relate software.

In case of build problems specific to this release please first check
https://dev.gnupg.org/T5743 for updated information.

Please consult the archive of the gnupg-users mailing list before
reporting a bug: https://gnupg.org/documentation/mailing-lists.html.
We suggest to send bug reports for a new release to this list in favor
of filing a bug at https://bugs.gnupg.org.  If you need commercial
support go to https://gnupg.com or https://gnupg.org/service.html.

If you are a developer and you need a certain feature for your project,
please do not hesitate to bring it to the gnupg-devel mailing list for
discussion.


Thanks
======

Since 2001 maintenance and development of GnuPG is done by g10 Code GmbH
and has mostly been financed by donations.  Three full-time employed
developers as well as two contractors exclusively work on GnuPG and
closely related software like Libgcrypt, GPGME and Gpg4win.

Fortunately, and this is still not common with free software, we have
now established a way of financing the development while keeping all our
software free and freely available for everyone.  Our model is similar
to the way RedHat manages RHEL and Fedora: Except for the actual binary
of the MSI installer for Windows and client specific configuration
files, all the software is available under the GNU GPL and other Open
Source licenses.  Thus customers may even build and distribute their own
version of the software as long as they do not use our trademark
GnuPG VS-Desktop?.

We like to thank all the nice people who are helping the GnuPG project,
be it testing, coding, translating, suggesting, auditing, administering
the servers, spreading the word, answering questions on the mailing
lists, or helping with donations.

*Thank you all*

   Your GnuPG hackers


p.s.
This is an announcement only mailing list.  Please send replies only to
the gnupg-users at gnupg.org mailing list.

List of Release Signing Keys:
To guarantee that a downloaded GnuPG version has not been tampered by
malicious entities we provide signature files for all tarballs and
binary versions.  The keys are also signed by the long term keys of
their respective owners.  Current releases are signed by one or more
of these four keys:

  rsa3072 2017-03-17 [expires: 2027-03-15]
  5B80 C575 4298 F0CB 55D8  ED6A BCEF 7E29 4B09 2E28
  Andre Heinecke (Release Signing Key)

  ed25519 2020-08-24 [expires: 2030-06-30]
  6DAA 6E64 A76D 2840 571B  4902 5288 97B8 2640 3ADA
  Werner Koch (dist signing 2020)

  ed25519 2021-05-19 [expires: 2027-04-04]
  AC8E 115B F73E 2D8D 47FA  9908 E98E 9B2D 19C6 C8BD
  Niibe Yutaka (GnuPG Release Key)

  brainpoolP256r1 2021-10-15 [expires: 2029-12-31]
  02F3 8DFF 731F F97C B039  A1DA 549E 695E 905B A208
  GnuPG.com (Release Signing Key 2021)

The keys are available at https://gnupg.org/signature_key.html and
in any recently released GnuPG tarball in the file g10/distsigkey.gpg .
Note that this mail has been signed by a different key.

-- 
The pioneers of a warless world are the youth that
refuse military service.             - A. Einstein
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20220421/5491dd93/attachment-0001.sig>
-------------- next part --------------
_______________________________________________
Gnupg-announce mailing list
Gnupg-announce at gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-announce

From wk at gnupg.org  Fri Apr 22 20:45:54 2022
From: wk at gnupg.org (Werner Koch)
Date: Fri, 22 Apr 2022 20:45:54 +0200
Subject: Digital Signature Verification
In-Reply-To: <CAFhV5Oe9nQ6OFMS-oT3aDn_U+3LoGv16Dh9hv=5hN+xdTjoYVA@mail.gmail.com>
 (Vishal Rana via Gnupg-users's message of "Tue, 19 Apr 2022 15:52:43
 +0530")
References: <CAFhV5Od5OfvS+ZZVr0o-5T9aUCy4wxEZpvK5+uySn0c+SyTRzQ@mail.gmail.com>
 <20220406153525.673a49bb@longlandclan.id.au>
 <CAFhV5OcvzHUBPTx1=dK5p4wR7ZRJbFWP_57ZX+ai+aYwe=5G=g@mail.gmail.com>
 <87y20hkml9.fsf@wheatstone.g10code.de>
 <CAFhV5OeU9_VF=C6P-KMA4QFuVKpf7dqEOuJsiJ6dsN0R82Eoig@mail.gmail.com>
 <CAFhV5OfDC7fHY7GFXTCgcR2hEbXD9NrRt67pKhJPqthu4+4t2w@mail.gmail.com>
 <8735iokkw6.fsf@wheatstone.g10code.de>
 <CAFhV5Oe9nQ6OFMS-oT3aDn_U+3LoGv16Dh9hv=5hN+xdTjoYVA@mail.gmail.com>
Message-ID: <87czh99ct9.fsf@wheatstone.g10code.de>

On Tue, 19 Apr 2022 15:52, Vishal Rana said:

> Digital signature verification is failing. Getting "*Bad signature*" error.
> How to debug this??

  gpg --debug hashing --verify ..

Creates files with the actual hashed data - compare them to thoe create
by the signing process.

> But observation is generated signature,"image.sig" files on both scenarios
> are different. means hexdump for image.sig in both scenario is different.

Sure they are. Please read up on digital signature algorithms.  See also
this status code we emit:

*** SIG_ID  <radix64_string>  <sig_creation_date>  <sig-timestamp>
    This is emitted only for signatures of class 0 or 1 which have
    been verified okay.  The string is a signature id and may be used
    in applications to detect replay attacks of signed messages.  Note
    that only DLP algorithms give unique ids - others may yield
    duplicated ones when they have been created in the same second.

    Note, that SIG-TIMESTAMP may either be a number of seconds since
    Epoch or an ISO 8601 string which can be detected by the presence
    of the letter 'T'.


Salam-Shalom,

   Werner


-- 
The pioneers of a warless world are the youth that
refuse military service.             - A. Einstein
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20220422/fd4c0a96/attachment.sig>

From vishal.rana118 at gmail.com  Sat Apr 23 04:02:08 2022
From: vishal.rana118 at gmail.com (Vishal Rana)
Date: Sat, 23 Apr 2022 07:32:08 +0530
Subject: Digital Signature Verification
In-Reply-To: <87czh99ct9.fsf@wheatstone.g10code.de>
References: <CAFhV5Od5OfvS+ZZVr0o-5T9aUCy4wxEZpvK5+uySn0c+SyTRzQ@mail.gmail.com>
 <20220406153525.673a49bb@longlandclan.id.au>
 <CAFhV5OcvzHUBPTx1=dK5p4wR7ZRJbFWP_57ZX+ai+aYwe=5G=g@mail.gmail.com>
 <87y20hkml9.fsf@wheatstone.g10code.de>
 <CAFhV5OeU9_VF=C6P-KMA4QFuVKpf7dqEOuJsiJ6dsN0R82Eoig@mail.gmail.com>
 <CAFhV5OfDC7fHY7GFXTCgcR2hEbXD9NrRt67pKhJPqthu4+4t2w@mail.gmail.com>
 <8735iokkw6.fsf@wheatstone.g10code.de>
 <CAFhV5Oe9nQ6OFMS-oT3aDn_U+3LoGv16Dh9hv=5hN+xdTjoYVA@mail.gmail.com>
 <87czh99ct9.fsf@wheatstone.g10code.de>
Message-ID: <CAFhV5OeMhApjRQ_KNwadUpAiYZ_Y6b8wDAK=Oo5YaQGVnfEWqw@mail.gmail.com>

Thank you very much for valuable reply , I'll check them out.

Regards,
Vishal Rana

On Sat, 23 Apr 2022, 12:16 am Werner Koch, <wk at gnupg.org> wrote:

> On Tue, 19 Apr 2022 15:52, Vishal Rana said:
>
> > Digital signature verification is failing. Getting "*Bad signature*"
> error.
> > How to debug this??
>
>   gpg --debug hashing --verify ..
>
> Creates files with the actual hashed data - compare them to thoe create
> by the signing process.
>
> > But observation is generated signature,"image.sig" files on both
> scenarios
> > are different. means hexdump for image.sig in both scenario is different.
>
> Sure they are. Please read up on digital signature algorithms.  See also
> this status code we emit:
>
> *** SIG_ID  <radix64_string>  <sig_creation_date>  <sig-timestamp>
>     This is emitted only for signatures of class 0 or 1 which have
>     been verified okay.  The string is a signature id and may be used
>     in applications to detect replay attacks of signed messages.  Note
>     that only DLP algorithms give unique ids - others may yield
>     duplicated ones when they have been created in the same second.
>
>     Note, that SIG-TIMESTAMP may either be a number of seconds since
>     Epoch or an ISO 8601 string which can be detected by the presence
>     of the letter 'T'.
>
>
> Salam-Shalom,
>
>    Werner
>
>
> --
> The pioneers of a warless world are the youth that
> refuse military service.             - A. Einstein
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20220423/617e270f/attachment.html>

From fa-ml at ariis.it  Sun Apr 24 22:34:45 2022
From: fa-ml at ariis.it (Francesco Ariis)
Date: Sun, 24 Apr 2022 22:34:45 +0200
Subject: Backing up your PGP key by hand
Message-ID: <YmW0ZcrFqJKvJfJ1@mkiii.casa>

Hello gnupg-users,
    I decided to back up my secret gpg key with pencil and paper,
documenting the process here

    http://ariis.it/static/articles/handwritten-pgp-key/page.html

It is tangent to gpg but I thought that other gnupg-users might have been
interested in the whys and hows of the topic
?F


From wk at gnupg.org  Mon Apr 25 21:03:45 2022
From: wk at gnupg.org (Werner Koch)
Date: Mon, 25 Apr 2022 21:03:45 +0200
Subject: [Announce] GnuPG 2.3.6 released
Message-ID: <87zgk96l4e.fsf@wheatstone.g10code.de>

Hello!

We are pleased to announce the availability of a new GnuPG release:
version 2.3.6.  This release fixes a regression introduced in 2.3.5
released just a few days ago.


What is GnuPG
=============

The GNU Privacy Guard (GnuPG, GPG) is a complete and free implementation
of the OpenPGP and S/MIME standards.

GnuPG allows to encrypt and sign data and communication, features a
versatile key management system as well as access modules for public key
directories.  GnuPG itself is a command line tool with features for easy
integration with other applications.  The separate library GPGME provides
a uniform API to use the GnuPG engine by software written in common
programming languages.  A wealth of frontend applications and libraries
making use of GnuPG are available.  As an universal crypto engine GnuPG
provides support for S/MIME and Secure Shell in addition to OpenPGP.

GnuPG is Free Software (meaning that it respects your freedom).  It can
be freely used, modified and distributed under the terms of the GNU
General Public License.

Three different series of GnuPG are actively maintained:

- Version 2.3 is the current stable version with a lot of new features
  compared to 2.2.  This announcement is about the latest release of
  this series.

- Version 2.2 is our LTS (long term support) version and guaranteed to
  be maintained at least until the end of 2024.
  See https://gnupg.org/download/index.html#end-of-life

- Version 1.4 is only maintained to allow decryption of very old data
  which is, for security reasons, not anymore possible with other GnuPG
  versions.


Noteworthy changes in version 2.3.6
===================================

  * gpg: Fix regression in 2.3.5 importing longer keys.  [T5941]

  * gpg: Emit an ERROR status as hint for a bad passphrase.  [T5943]

  * gpg: Avoid NULL-ptr access due to corrupted packets.  [T5940]

  * gpgsm: Improve the "Certificate not found" error message.  [T5821]

  * agent: Pass pattern directly to gpg-check-pattern.  [rGe529c54fe3]

  * scd: Fix hard-coded constant for RSA authentication key OpenPGP.3.
    [rG2848fe4c84]

  Release-info: https://dev.gnupg.org/T5937
  

Getting the Software
====================

Please follow the instructions found at <https://gnupg.org/download/> or
read on:

GnuPG may be downloaded from one of the GnuPG mirror sites or direct
from its primary FTP server.  The list of mirrors can be found at
<https://gnupg.org/download/mirrors.html>.  Note that GnuPG is not
available at ftp.gnu.org.

The GnuPG source code compressed using BZIP2 and its OpenPGP signature
are available here:

 https://gnupg.org/ftp/gcrypt/gnupg/gnupg-2.3.6.tar.bz2 (7426k)
 https://gnupg.org/ftp/gcrypt/gnupg/gnupg-2.3.6.tar.bz2.sig

An installer for Windows without any graphical frontend except for a
very minimal Pinentry tool is available here:

 https://gnupg.org/ftp/gcrypt/binary/gnupg-w32-2.3.6_20220425.exe (4746k)
 https://gnupg.org/ftp/gcrypt/binary/gnupg-w32-2.3.6_20220425.exe.sig

The source used to build the Windows installer can be found in the same
directory with a ".tar.xz" suffix.  A release of gpg4win including this
version of GnuPG is scheduled for tomorrow.


Checking the Integrity
======================

In order to check that the version of GnuPG which you are going to
install is an original and unmodified one, you can do it in one of
the following ways:

 * If you already have a version of GnuPG installed, you can simply
   verify the supplied signature.  For example to verify the signature
   of the file gnupg-2.3.6.tar.bz2 you would use this command:

     gpg --verify gnupg-2.3.6.tar.bz2.sig gnupg-2.3.6.tar.bz2

   This checks whether the signature file matches the source file.
   You should see a message indicating that the signature is good and
   made by one or more of the release signing keys.  Make sure that
   this is a valid key, either by matching the shown fingerprint
   against a trustworthy list of valid release signing keys or by
   checking that the key has been signed by trustworthy other keys.
   See the end of this mail for information on the signing keys.

 * If you are not able to use an existing version of GnuPG, you have
   to verify the SHA-1 checksum.  On Unix systems the command to do
   this is either "sha1sum" or "shasum".  Assuming you downloaded the
   file gnupg-2.3.6.tar.bz2, you run the command like this:

     sha1sum gnupg-2.3.6.tar.bz2

   and check that the output matches the next line:

56706129203f422f4e5133ea76f5e72e05b0a404  gnupg-2.3.6.tar.bz2
26f937dc1a09e27426a45e51d7848954773edbbb  gnupg-w32-2.3.6_20220425.tar.xz
cf499dd9f6682d1b6bcc125b38b406e079be73ef  gnupg-w32-2.3.6_20220425.exe


Internationalization
====================

This version of GnuPG has support for 26 languages with Chinese
(traditional and simplified), Czech, French, German, Italian,
Japanese, Norwegian, Polish, Russian, and Ukrainian being almost
completely translated.


Documentation and Support
=========================

The file gnupg.info has the complete reference manual of the system.
Separate man pages are included as well but they miss some of the
details available only in the manual.  The manual is also available
online at

  https://gnupg.org/documentation/manuals/gnupg/

or can be downloaded as PDF at

  https://gnupg.org/documentation/manuals/gnupg.pdf

You may also want to search the GnuPG mailing list archives or ask on
the gnupg-users mailing list for advise on how to solve problems.  Most
of the new features are around for several years and thus enough public
experience is available.  https://wiki.gnupg.org has user contributed
information around GnuPG and relate software.

In case of build problems specific to this release please first check
https://dev.gnupg.org/T5937 for updated information.

Please consult the archive of the gnupg-users mailing list before
reporting a bug: https://gnupg.org/documentation/mailing-lists.html.
We suggest to send bug reports for a new release to this list in favor
of filing a bug at https://bugs.gnupg.org.  If you need commercial
support go to https://gnupg.com or https://gnupg.org/service.html.

If you are a developer and you need a certain feature for your project,
please do not hesitate to bring it to the gnupg-devel mailing list for
discussion.


Thanks
======

Since 2001 maintenance and development of GnuPG is done by g10 Code GmbH
and has mostly been financed by donations.  Three full-time employed
developers as well as two contractors exclusively work on GnuPG and
closely related software like Libgcrypt, GPGME and Gpg4win.

Fortunately, and this is still not common with free software, we have
now established a way of financing the development while keeping all our
software free and freely available for everyone.  Our model is similar
to the way RedHat manages RHEL and Fedora: Except for the actual binary
of the MSI installer for Windows and client specific configuration
files, all the software is available under the GNU GPL and other Open
Source licenses.  Thus customers may even build and distribute their own
version of the software as long as they do not use our trademark
GnuPG VS-Desktop?.

We like to thank all the nice people who are helping the GnuPG project,
be it testing, coding, translating, suggesting, auditing, administering
the servers, spreading the word, answering questions on the mailing
lists, or helping with donations.

*Thank you all*

   Your GnuPG hackers


p.s.
This is an announcement only mailing list.  Please send replies only to
the gnupg-users at gnupg.org mailing list.

List of Release Signing Keys:
To guarantee that a downloaded GnuPG version has not been tampered by
malicious entities we provide signature files for all tarballs and
binary versions.  The keys are also signed by the long term keys of
their respective owners.  Current releases are signed by one or more
of these four keys:

  rsa3072 2017-03-17 [expires: 2027-03-15]
  5B80 C575 4298 F0CB 55D8  ED6A BCEF 7E29 4B09 2E28
  Andre Heinecke (Release Signing Key)

  ed25519 2020-08-24 [expires: 2030-06-30]
  6DAA 6E64 A76D 2840 571B  4902 5288 97B8 2640 3ADA
  Werner Koch (dist signing 2020)

  ed25519 2021-05-19 [expires: 2027-04-04]
  AC8E 115B F73E 2D8D 47FA  9908 E98E 9B2D 19C6 C8BD
  Niibe Yutaka (GnuPG Release Key)

  brainpoolP256r1 2021-10-15 [expires: 2029-12-31]
  02F3 8DFF 731F F97C B039  A1DA 549E 695E 905B A208
  GnuPG.com (Release Signing Key 2021)

The keys are available at https://gnupg.org/signature_key.html and
in any recently released GnuPG tarball in the file g10/distsigkey.gpg .
Note that this mail has been signed by a different key.


-- 
The pioneers of a warless world are the youth that
refuse military service.             - A. Einstein
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20220425/d8344d95/attachment.sig>
-------------- next part --------------
_______________________________________________
Gnupg-announce mailing list
Gnupg-announce at gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-announce