GnuPG – post-quantum crypto landing in mainline

zzdkaster about 6 hours ago 17 commentsRead Article on lists.gnupg.org

FR version is available. Content is displayed in original English for accuracy.

⚡ Community Insights

Discussion Sentiment

69% Positive

Analyzed from 725 words in the discussion.

Discussion (17 Comments)Read Original on HackerNews

dsecurity49•about 3 hours ago

The Snowden quote at the bottom of every single Werner Koch email has been living rent-free in my head since 2013. Also the fact that this project has been running since the late 90s, financed almost entirely by donations, and is quietly protecting basically all serious encrypted communication on the planet — and the announcement still goes out as a plain text email to a mailing list. No Medium post. No Twitter thread. No 'we're excited to share'. Just: here's the tarball, here's the SHA-1, verify it. Absolute last line of defense energy.

jore•about 2 hours ago

I haven’t heard this quote before, but I am copying it here because it makes so much sense:

Arguing that you don't care about the right to privacy because you have nothing to hide is no different from saying you don't care about free speech because you have nothing to say. - Edward Snowden

pabs3•about 1 hour ago

IIRC the GnuPG folks do a lot of consulting and sell additional software:

https://gnupg.org/service.html https://gnupg.com/ https://g10code.com/

gtsnexp•about 2 hours ago

This is deeply inspiring 'No Medium post. No Twitter thread. No 'we're excited to share'. Just: here's the tarbal' Thank you!

snthpy•about 1 hour ago

And they use SHA-1 for verification?

noosphr•34 minutes ago

   If you already have a version of GnuPG installed, you can simply
   verify the supplied signature.  For example to verify the signature
   of the file gnupg-2.5.19.tar.bz2 you would use this command:

     gpg --verify gnupg-2.5.19.tar.bz2.sig gnupg-2.5.19.tar.bz2

   This checks whether the signature file matches the source file.
   You should see a message indicating that the signature is good and
   made by one or more of the release signing keys.  Make sure that
   this is a valid key, either by matching the shown fingerprint
   against a trustworthy list of valid release signing keys or by
   checking that the key has been signed by trustworthy other keys.
   See the end of this mail for information on the signing keys.

 * If you are not able to use an existing version of GnuPG, you have
   to verify the SHA-1 checksum.  On Unix systems the command to do
   this is either "sha1sum" or "shasum".  Assuming you downloaded the
   file gnupg-2.5.19.tar.bz2, you run the command like this:

aborsy•about 1 hour ago

Does it implement the hybrid version ML-KEM-768 + X25519 or ML-KEM-768 only ?

The X25519 key could remain in hardware keys for a while til manufactures catch up.

utopiah•about 3 hours ago

> introduction of Kyber (aka ML-KEM or FIPS-203) as PQC encryption algorithm

Funny to read 1-liner changelog versus the plethora of articles just few years ago along the line of "Quantum computer, it might just change our entire lives and make privacy impossible!".

The simple addition (of a not so simple algorithm) to the software (and few others, e.g. OpenSSL) and voila, me can move on with our daily lives. Cryptography and computational complexity are truly amazing.

zdkaster•about 6 hours ago

GnuPG Version 2.5.19

The 2.5 series are improvements for 64 bit Windows and the introduction of Kyber (aka ML-KEM or FIPS-203) as PQC encryption algorithm.

The old 2.4 series reaches end-of-life in just two months.

growse•24 minutes ago

I don't know enough about either the technical nuance or the political drama, but some observers have noted that GnuPG's implementation is (deliberately?) incompatible with the IETF's standards. It's not clear why.

https://floss.social/@hko/116459621169318785

trueno•about 2 hours ago

been thinking about this a bit. someone just tell me what algo to use and ill start using it now. are the quantum-resistant cryptos significantly slower?

d1sxeyes•about 2 hours ago

Basically the idea is use hybrid. AES-GCM-256 or ChaCha20-Poly1305 for symmetric encryption (which is already PQ-safe), and ML-KEM looks set to become the standard for key encapsulation.

ML-KEM-768 is fast as an algorithm, faster than X25519 in terms of pure computation, but uses large keys, so has higher overheads on small payloads. Most of the time, they’re about equal, or the absolute time is so slow it doesn’t matter.

Most folks now are doing hybrid ML-KEM and X25519 to guard against undiscovered flaws in ML-KEM.

purplehat_•about 2 hours ago

For people reading this, you may want to know the the NSA is allegedly trying to weaken hybrid ML-KEM and X25519 down to just ML-KEM. This is a good thing to pay attention to!

Here is a 6-part article about the topic: https://blog.cr.yp.to/20251004-weakened.html

purplehat_•about 2 hours ago

I believe ML-KEM is the standard algorithm for post-quantum asymmetric encryption. I think it's slower mainly because there's not good hardware support, but it shouldn't be a big deal because most encryption is hybrid where you only use the asymmetric crypto briefly to share a secret you can use for symmetric cryptography.

ML-KEM based on a lattice problem called "Learning With Errors", and there are similar lattice-based algorithms which have no known quantum speedup. Most traditional asymmetric encryption algorithms are based on number-theoretic assumptions like the discrete logarithm problem or the RSA assumption, which are broken by Shor's algorithm.

Symmetric cryptography (AES and SHA hash functions) are post-quantum resistant for now. Grover's algorithm technically cuts their asymptotic security in half, but that doesn't parallelize, so practically there is no known good quantum attack, and cryptographers and standards agencies tend to not worry about that. You can keep using those.

[edit: according to the sister comment posted simulataneously ML-KEM is faster than X25519. good to know!]

immanuwell•about 1 hour ago

cool, now my emails that nobody's reading anyway are safe from quantum computers that don't exist yet

PunchyHamster•about 1 hour ago

it's mostly to make clowns repeating "It's not PQ secure therefore bad" happy I think

sipsi•about 1 hour ago

tard level 11