Suggestions of standards added to openpgp/Gnupg/LibrePgp

[Robert J. Hansen]

> Shamirs secret has been around since 1979,- I find it odd that it is not 
> included in Openpgp.

LibrePGP (not OpenPGP) has very little to say about how keys are stored, 
accessed, or shared. It specifies a format by which keys can be output 
by one application and input to another, but specifying a common 
import/export format is pretty minimal.

> It could add things like distributed key custody, hardware enforced 
> split custody. Right now,- if someone with a key leaves or dies 
> important encrypted data gets lost.

No, because enterprises concerned about this use ADKs (which really 
should be called ARRs, but I lost that battle a quarter-century ago).

> That would cause issues for any organization.   It could also fix the 
> plausible "only one person knows the password" to a " K of N can 
> cooperate" situation.

So the sysadmin gets the private key, puts a strong 128-bit random 
passphrase on it, and then uses any of the commonly-available 
command-line Shamir implementations to do a K-of-N key breakup among the 
junior sysadmins.

> That would also work for a encrypted file system,- split into parts.
> If a hardware token has , say 256 GB space.. Then it can be a part of a 
> Shamirs secret scheme.  4 out of 6 keys could be used to recreate the 
> shared encrypted file system on a empty drive.

Why not just use the drive's full capacity, encrypt it with a 256-bit 
key, and use Shamir to do K-of-N on the key? This scheme seems wasteful. 
And why do you need Shamir in LibrePGP in order to achieve this?

> Ephemeral signed elliptic curve diffie hellman is usable, because it 
> will solve a forward security issue.

So far you don't appear to understand LibrePGP or Shamir very well. That 
is not an insult: everybody starts off not knowing this stuff. But your 
past track record so far makes me less willing to take your assertion on 
faith than if you were Ron Rivest.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 236 bytes
Desc: OpenPGP digital signature
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20260331/90d6c53c/attachment.sig>