Announcing gopass – A 'pass' compatible password manager for teams

Re:Announcing gopass – A 'pass' compatible password manager ... by e12e on Thursday February 02, 2017 @04:29PM (#13554833)

You're aware of an attack on RSA that weakens it when a short random string is encrypted with a handful of RSA keys as opposed to a single key?

Afaik supplying multiple ids to gpg simply re-encryps the same symmetric key for multiple recipients - the plaintext is turned into a single cipher text.

[ Parent | on HN ]

Re:Announcing gopass – A 'pass' compatible password manager ... by hackcasual on Thursday February 02, 2017 @07:05PM (#13556331)

There is an attack against RSA if you encrypt very small values with a small exponent and insecure padding. GPG generates a large symmetric encryption key, and uses that to encrypt the message, uses 65537 (as is considered good practice) as its exponent, and uses a cryptographically appropriate PKCS#1v1.5 padding scheme

As far as I'm aware, there's no reduction in security by encrypting to multiple public keys (other than increased risk of compromising one of the keys).

[ Parent | on HN ]