Heiko / is on Nostr

I work on the https://openpgp-ca.org decentralized certification authority tool, Rust client libraries for OpenPGP card and other HSM devices, and other adjacent projects.

Last Notes

2024-06-23 18:09:22

I just released rsop 0.3.5 (https://crates.io/crates/rsop5).
rsop is a stateless #OpenPGP CLI tool based on rPGP. It can be used to perform standard OpenPGP operations with a vendor agnostic interface.
This release fixes support for multiple signatures within one message. Previously, when more than one signature was made, only one of the signatures was issued correctly.
#GnuPG #GPG #PGP

2024-06-09 22:13:01

Apparently the EU elections are telling us that we need to continue working on decentralized privacy tools.

2024-06-04 14:01:21

- reply

@npub16uz…xx07 that looks unreal O_o

2024-06-03 22:12:14

- reply

Btw 😏, oct is packaged for #ArchLinux:
https://archlinux.org/packages/extra/x86_64/openpgp-card-tools/

2024-05-28 21:59:25

I just released openpgp-card v0.5.0: https://crates.io/crates/openpgp-card/0.5.0
openpgp-card is a Rust client library for using #OpenPGP card hardware security devices.
This version comes with a significantly adjusted API:
The low-level API has been moved to the "ocard" module. At the top level of the crate, more convenient abstractions are now directly available (including PIN handling for cards in KDF mode).
#HSM #RustLang #PGP #GnuPG #gpg #Rust

2024-05-26 10:00:17

30 years ago today, #PGP 2.6 was released via MIT.
Up to this point, two major issues had been unresolved: The legal status of the use of RSA in PGP, and export of the software from the US to the rest of the world.
With the release of PGP 2.6, the first of these two issues was resolved.
The pre-history of #OpenPGP, #gpg, #gnupg is hard to imagine, today. Even though variations of the https://en.m.wikipedia.org/wiki/Crypto_Wars remain a (tiringly) recurring political battle ground, three decades later.

2024-05-19 21:41:42

- reply

@npub16uz…xx07 i would like to file a complaint: this does not look like a tui!

2024-05-18 18:03:14

- reply

@npub1h4m…f22a you might consider taking a look at https://crates.io/crates/openpgp-card-tools :)

2024-05-06 15:48:12

- reply

oct-git and its sibling project https://crates.io/crates/openpgp-card-ssh-agent are concrete options for OpenPGP card users to explore OpenPGP use without GnuPG, today.
In addition, the #rsop "Stateless OpenPGP" tool (https://crates.io/crates/rsop) also supports using OpenPGP card devices (see https://datatracker.ietf.org/doc/draft-dkg-openpgp-stateless-cli/ for more).

2024-04-25 12:37:36

I just released version 0.10.1 of https://crates.io/crates/openpgp-card-tools, the general purpose "oct" #OpenPGP card tool.
This release adds the "oct admin signing-pin-validity" subcommand, to configure if a card requires User PIN presentation for each signature operation, or if User PIN presentation is valid for the full duration of a connection to the card.
(#GnuPG calls this flag "forcesig")
#rustlang #PGP #gpg

2024-04-23 16:17:32

- reply

@npub16uz…xx07 infinite browser -> TUI -> browser recursion, when? 😄

2024-04-11 18:16:02

Two days ago I switched my OpenPGP card-based #git signing setup away from gpg to an experimental new Rust alternative.
I did not realize how much of a quality of life improvement that would be. Very excited that pin entry popups are (almost entirely) a thing of the past for me, now.

2024-03-31 14:20:02

The #Rust ecosystem gets a number of things right. Among the ones I appreciate a lot is strong encouragement of canonical formatting with #rustfmt.
Canonical formatting, enforced by CI, makes it much harder to e.g. strategically hide a stray dot in source code in a way that is easy to overlook - and to miss its semantical impact.

2024-02-05 21:35:23

Having decidedly too much fun playing with ancient #PGP artifacts.
Note the two version 2 public keys from 1992. They were created just over a year after Phil Zimmermann first released PGP (on 6 June 1991), deep in the crypto war era.
These keys predate the #OpenPGP name by around half a decade.
At over 31 years old, nation-state actors can definitely factor John Gilmore's RSA 1024 key today.
However, I believe the cost still exceeds a hobbyist budget even now.
https://cdn.fosstodon.org/media_attachments/files/111/880/714/348/320/604/original/0bec792c08422405.png