Re: [Merit] Hey Bitcoiners! Can You Send Encrypted Messages?

Good thread. Offering merits is more likely to succeed than offering 2²⁵⁶% airdrop bounties.

A private message for OgNasty—others MUST NOT read:

Code:

My public key is available from Nullian Verification. Its fingerprint has been in my signature ever since I was at Newbie rank, as may be viewed in any archives of my posts.

PSA: Always make sure that you have the right key!

Quote from: DdmrDdmr on November 17, 2020, 12:34:37 PM

(I’ve used https://www.lirnberger.com/tools/pgpdump/ to see the header info).

You can also use gpg -v -v, with shell redirects of stderr to a pager. E.g.:

Code: (/bin/sh)

gpg -v -v < message.asc 2>&1 | less

I also recommend using shell redirects to encrypt messages for forum PMs. This will avoid leaking the filename into the PGP metadata, as would occur if you provide gpg with the filename as an argument. The exact command that I used to encrypt the above message to OgNasty:

Code: (/bin/sh)

gpg -a -s -e -r 0xA338C617DE66E656 -r 0x5A00591B2F307E0C < 2020-11-26.ognasty.txt > 2020-11-26.ognasty.asc

Quote from: Husna QA on November 18, 2020, 07:07:31 AM

Quote from: Maus0728 on November 18, 2020, 04:49:36 AM

-snip- It's pretty easy to import the public key but I doubt there is something wrong since the public key you've given is different which is ECC (Elliptic Curve Cryptography). -snip-

I am trying to show the Public key with an algorithm other than RSA.

I myself recommend and use ECC, specifically ed25519 (signing/certification) and cv25519 (encryption (ECDH)) keys. GnuPG-compatible OpenPGP ECC implementations now include Protonmail; I recommend that Protonmail users should switch to “X25519” keys for an optimal combination of security and performance. The substance of Werner Koch’s specification for this is being rolled into the OpenPGP standard under RFC 4880bis.

This is a newbie thread, so here is one of my Newbie posts about ECC in PGP:

Quote from: nullius on December 19, 2017, 02:36:52 AM

Quote from: Andre_Goldman on December 19, 2017, 02:13:13 AM

ps-> nullius how did you get a PGP Ed25519: 0xC .... ?

GnuPG supports ECC since version 2.1. Requires options `--full-gen-key --expert` (or noninteractive key generation as I used). NIST and Brainpool curves are supported; but also: “For many people the NIST and also the Brainpool curves have an doubtful origin and thus the plan for GnuPG is to use Bernstein’s Curve 25519 as default. GnuPG 2.1.0 already comes with support for signing keys using the Ed25519 variant of this curve. This has not yet been standardized by the IETF (i.e. there is no RFC) but we won’t wait any longer....”

Much PGP software does not yet support my Curve25519 keys. My .sig reminds me of the 90s, when people had both PGP2/PGP5 keys. In the mass market, interestingly, Keybase can use my ECC keys just fine. I’m not sure if that’s a good thing.

Quote from: Maus0728 on November 18, 2020, 02:36:14 PM

try changing the default key server in Kleopatra which is the "hkps: //hkps.pool.sks-keyservers.net" to the remaining publicly available key servers.

(And some other posts on this thread.)

The old keyserver network is deprecated. I recommend avoiding it, including both SKS and the MIT PGP server.

The problem is systemic, due to design-level vulnerabilities. Thus, there are currently efforts to make new standards for “abuse-resistant” keyservers, and alternative means of distributing keys.

Quote from: https://dkg.fifthhorseman.net/blog/openpgp-certificate-flooding.html

OpenPGP Certificate Flooding
Fri 28 June 2019
By Daniel Kahn Gillmor (dkg)

My public cryptographic identity has been spammed to the point where it is unusable in standard workflows. This blogpost talks about what happened, what I'm doing about it, and what it means for the broader ecosystem.

Upload your key to https://keys.openpgp.org/, and also check to see if your mail provider supports Web Key Directory (WKD). Unfortunately, both of those options will force the stripping of non-mail-address userids. Therefore, I recommend posting your key on the forum (or elsewhere on the Web), as I do on the Nullian Verification thread.

Trolling the NSA

OgNasty will not be able to decrypt the following messages; I hope that the NSA will not be able to, either. ;-)

Quote from: nullius on September 07, 2020, 12:16:31 AM

Quote from: Last of the V8s on September 06, 2020, 08:21:24 PM

fine. keep your secrets Roll Eyes

In Bitcoinland, it is unsurprising that some should be cryptic.

Code:

Quote from: nullius on March 15, 2020, 05:53:59 PM

Quote from: nullius on February 20, 2020, 04:29:03 PM

Just as the best of thought was once upon a time writ in classical Latin, or even reserved in Greek, or...

* nullius is currently seeking Sanskrit translators for his most precious thoughts.

...kept private.

Code:

Information wants to be valued—and I do not mean that in the monetary sense. Intelligence is priceless.

Quote from: nullius on March 14, 2018, 11:58:45 PM

Quote from: siddartha1492 on March 14, 2018, 05:46:32 PM

Nullius is certainly a member of Cicada 3301 group. Just search about it on internet, and you will find way too many similarities! 😄

Code:

Code:

e95fb2193dd348de266b7cc350b8c643c472af82e06987d4a34916e5c5b68970

Code:

d26ce23462834637dc23c09e64b60cf9d207db8779c4110b8125a0b30a6b02ab

Quote from: suparigach on November 17, 2020, 07:05:48 PM

I created different site.
https://www.igolder.com/pgp/generate-key/
https://www.igolder.com/PGP/encryption/
https://www.igolder.com/PGP/decryption/

This is a horribly stupid idea. DO NOT USE!

Quote from: https://www.igolder.com/pgp/generate-key/

Generate your private and public PGP keys online. This PGP key generator is does not require you to install any software and your PGP keys remain confidential. iGolder does not log any activity done on this page. We created this tool for you to benefit PGP encryption for contacting us, contacting any iGolder member having a public PGP key, or contacting your friends.

iGolder respects your privacy and does not log nor monitors any activity (key creation) done on this web page.

= “Trust us!” Roll Eyes

I did not waste the time to figure out what if any Javascript affects this, but it does look like all key generation and encryption is done on the server:

Code: (html)

This is not like Protonmail or Keybase’s web app (already questionable trust issues, IMO). On iGolder’s site, all secret key material and message plaintext are sent to the server!

If you use this for “contacting your friends” as they suggest, then you are screwing your friends over—and you are untrustworthy to them. DO NOT USE!