Reflections on the integration of post-quantum cryptography

[[email protected]]

– Key verification: OpenPGP’s trust model is difficult to explain to non-technical users. We do public key fingerprint verification using various alternative channels, which are mostly not convenient. Public key fingerprints could be transferred using other secure means (e.g. WhatsApp/Signal/…) or ZRTP and Signal protocol (i.e. Silent phone). The idea would be to use other means or systems besides OpenPGP to leverage (enforce) trust, instead of using the current PGP trust model.
– Lack of network effect in OpenPGP: mostly due to its armenia whatsapp number data 5 million operational complexity, we have not been able to reach more users. Let’s overcome this by taking good note of what has happened in systems that have already successfully exploited the network effect
– We look forward to meeting people interested in improving/modernizing the OpenPGP standard.

– We should also start focusing on using post-quantum cryptography in OpenPGP. The time has come.
– Post-quantum keys can be huge; let’s not transport the keys but rather the fingerprints, and let’s download the keys from some kind of next-generation key server.



In the future
4th OpenPGP Email Summit (20-Oct-2018) at Mailfence HQ: Mr. Salman Nadeem (Security and Information Analyst – Mailfence) with Mr. Phil Zimmermann (Creator of OpenPGP, Co-Founder of Silent Circle)
4th OpenPGP Email Summit (20-Oct-2018) at Mailfence HQ: Mr. Salman Nadeem (Security and Information Analyst – Mailfence) with Mr. Phil Zimmermann (Creator of OpenPGP, Co-Founder of Silent Circle)
– Current standard RFC4880; Draft new standard RFC4880bis; Working Group: https://tools.ietf.org/wg/openpgp/
– Deprecate old/obsolete cryptographic primitives: ciphers, compression algorithms, etc. and other design choices (e.g. replace MDC with AEAD).
– Get rid of old stuff, trim as much as possible while fitting improvement points into the existing syntactic framework.