From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 3C9911384B4 for ; Tue, 29 Dec 2015 14:03:41 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id EC1C021C068; Tue, 29 Dec 2015 14:03:24 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 0878821C065 for ; Tue, 29 Dec 2015 14:03:24 +0000 (UTC) Received: from [IPv6:2001:67c:20a1:1192:2677:3ff:fe45:edb4] (unknown [IPv6:2001:67c:20a1:1192:2677:3ff:fe45:edb4]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: k_f) by smtp.gentoo.org (Postfix) with ESMTPSA id 68D0234085D for ; Tue, 29 Dec 2015 14:03:22 +0000 (UTC) Subject: Re: [gentoo-dev] [RFC] New project: Crypto References: <5655EBF0.9000804@gentoo.org> <56560A11.8030700@gentoo.org> <56561851.2020900@gentoo.org> <20151228014934.e94250f4670cde139dbc7867@gentoo.org> <21A8380F-6010-4CDD-8DEF-02FA11217D21@gentoo.org> <20151228145813.40343a43@symphony.aura-online.co.uk> <9AB9A178-B4A1-4493-A3A4-0B3A855E603F@gentoo.org> To: gentoo-dev@lists.gentoo.org From: Kristian Fiskerstrand X-Enigmail-Draft-Status: N1110 Message-ID: <5682918A.5070003@gentoo.org> Date: Tue, 29 Dec 2015 14:58:34 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.4.0 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Archives-Salt: 9b9f406b-0627-40a7-a38e-48a8b19bd124 X-Archives-Hash: 3bdddd9eb9fedd1408a74b8e9f8405f2 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On 12/28/2015 07:35 PM, Rich Freeman wrote: > On Mon, Dec 28, 2015 at 10:07 AM, Kristian Fiskerstrand > wrote: >>> On 28 Dec 2015, at 15:58, James Le Cuirot >>> wrote: >>> > That concern is hardly unique to phones. PCs suffer just as much > from this problem. The solution could potentially be the same. > For But here we already have smartcards (that everyone should and _is_ using... right?) > signing it is a straightforward problem since there is nothing to > be kept secret except the key material itself (just send the > message to the signing device, and return the signature back). For > encryption for clarity (and what I think you already mean), the message in this case is the message to be signed (which is likely a blinded hash or something, so much shorter than the original data) > you have additional challenges if you want to be able to make any > use of the plaintext without it getting stolen - once decrypted it > is only secure as any device that comes in contact with it. And > there is no Indeed, but at least the device won't be able to decrypt further communication as it'd only have access to the session key of the particular message. Loosing control of the private (sub)key is substantially worse, so that might actually be ok for the security parameters of the users. > reason that mobile and browser frameworks couldn't talk to such > devices with the right standards. > > If it were up to me the government would hand out signing devices > just as they hand out passports. This already happen in several countries, including Germany and on a semi-related variant Norway (its government approved to sign electronically using BankID, where the banks does the verification). In germany there is even a CA that checks the government ID and certify OpenPGP keys based on it. - -- Kristian Fiskerstrand Public PGP key 0xE3EDFAE3 at hkp://pool.sks-keyservers.net fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3 -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJWgpGGAAoJECULev7WN52FHM4H/3hRy9UcmNtQ9cXOKR6xvwPy jso78Adi2EP4rGdMJrczBO7ymG5NSxF3rtVel1UjyYfT8x3MEgPfyyG26yGUOo6X tyL5dBiZ6dLCDMDAJdc3tTuLkgaRCkyPZFva6qOp3DgHMAez+wQTKTkmzpMGmG8M UxqrUWOS/7cGx5Dp+GOYWqd6nx+xrzwg63UbZqstwpPGZVp1BzI/Cat0KQv2j+q1 SU7IKvl4B2HmuL7BeZrc1H7Vj4BmUC1bgw5jnaA0E5oAsHvYefVxBQkt6sroxrbJ 8cXm4NGFRrLf4YkO/x7T7CRxnVLcGKdNkrKJDquCcsPHbc9oR44JBiXdO4OaWd4= =dIzk -----END PGP SIGNATURE-----