News for hackers. Stuff that matters.
Re:A New Future for GnuPG by upofadown on Tuesday January 04, 2022 @06:29AM (#29793692)
>...the practical impact of a better authentication might be low in many use cases; but it has become a political problem...

In the ways that GnuPG is normally used the practical impact is zero because that is not how a stateless, offline protocol works. The content is authenticated by signing it directly, thus avoiding the extra complexity of a stateful connection oriented authentication scheme. The details here:

* https://articles.59.ca/doku.php?id=pgpfan:authenticated

So should functionality be added here for what would be purely political reasons? Or should the political purpose be spun off into a separate utility?

Re:A New Future for GnuPG by tptacek on Tuesday January 04, 2022 @11:06AM (#29796307)
This is such a random argument, and you bring it up in every thread about PGP. No, it's not at all the case that authenticated encryption is only meaningful in "stateful, online protocols", nor is it the case that signatures and authentication tags are interchangeable. Even PGP doesn't agree with this weird argument.
Re:A New Future for GnuPG by phyzome on Wednesday January 05, 2022 @07:46AM (#29808266)
This is a category error. Authenticated encryption does not require statefulness. Just look at NaCl's cryptobox.
Re:A New Future for GnuPG by upofadown on Wednesday January 05, 2022 @05:28PM (#29816009)
The state is the authentication here. For stuff that is only sent once you can check the signature and you are done. Otherwise you have to maintain it for the duration of the connection and you are not going to want to sign every single message sent.