[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <4bb0e4f7-a4f3-45cc-b519-2044b4b2871c@gmail.com>
Date: Sun, 28 Dec 2025 19:48:13 -0500
From: Demi Marie Obenour <demiobenour@...il.com>
To: oss-security@...ts.openwall.com
Subject: Best practices for signature verifcation
In light of the recent GnuPG vulnerabilities, I remembered that OpenPGP
is almost never the right choice. CMS/PKCS#7 isn't any better, and
X.509 is also bad except that its extremely wide deployment in TLS
keeps it alive.
See <https://www.latacora/com/blog/2019/07/16/the-pgp-problem/>
and <https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/>.
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Download attachment "OpenPGP_0xB288B55FFF9C22C1.asc" of type "application/pgp-keys" (7141 bytes)
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
