[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87o6nhhwyn.fsf@gentoo.org>
Date: Mon, 29 Dec 2025 20:09:04 +0000
From: Sam James <sam@...too.org>
To: oss-security@...ts.openwall.com, Werner Koch <wk@...pg.org>
Cc: "Lexi Groves (49016)" <contact@....fail>, jcb62281@...il.com, Solar
Designer <solar@...nwall.com>
Subject: Re: Many vulnerabilities in GnuPG
Henrik Ahlgren <pablo@...stieto.com> writes:
> "Lexi Groves (49016)" <contact@....fail> writes:
>
>> Yes. We found this advice in [The GNU Privacy Handbook, Chapter 1.
>> Getting Started, Making and verifying
>> signatures](https://www.gnupg.org/gph/en/manual/x135.html):
>
> I'd just like to point out that the GNU Privacy Handbook (GPH) was
> published in 1999, and I have not encountered any more recent revisions.
I got this impression but couldn't find anything specifically saying it
was archived.
I filed a bug earlier and included https://dev.gnupg.org/T7993#210212
for one issue in it, but if it's not been revised since, perhaps it
should be archived with a banner on each page or something, as it's
readily found via search engines at the moment.
> I believe GnuPG did not even support RSA until version 1.0.3 and
> AES/Rijndael until version 1.0.4, which were released in 2000, meaning
> the handbook exclusively addresses DSA and ElGamal, making it 25 years
> out of date.
The GnuPG versions in the output got me suspicious enough ;)
>
> The GnuPG Manual (https://gnupg.org/documentation/manuals/gnupg/) is
> much more current, but sadly it is not structured as a user guide that
> would introduce a new user to PGP concepts and best practices, etc.
sam
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
