Heiko

Various #OpenPGP-related activities, mostly in #Rustlang.

- Very lean modern OpenPGP: https://minipgp6.org/ (minipgp6 (npub1paa…fhpu))

- Contributor to [@rpgp](https://mastodon.social/@rpgp )

- Blog/writeups: https://openpgp.foo

- OpenPGP card (hardware security device) projects: https://codeberg.org/heiko#openpgp-card

codeberg: https://codeberg.org/heiko
OpenPGP for application developers: https://openpgp.dev
v4 OpenPGP certificate: https://pgpkeys.eu/pks/lookup?op=get&search=0x23da7c0eaa711f0170013595b518d342eb2d4805
v6/PQC OpenPGP certificate: https://pgpkeys.eu/pks/lookup?search=0572eb3a91034f33223e0be865700d3ece403e09bfc687123f14ad223b6ecec2&op=index

Last Notes

2026-10-03 15:55:50 GMT

- reply

I keep parsing this as "misfortune cookie" and then I get really confused because she looks so happy!

2026-10-03 15:55:37 GMT

- reply

I keep parsing this as "misfortunecookie" and then I get really confused because she looks so happy!

2026-06-29 12:11:44 GMT

- reply

AC is traditionally extremely uncommon in private spaces in Germany (and much of Europe i assume).
It seems clear that this will change rapidly over the next few years.

2026-06-08 20:12:12 GMT

The https://openpgp.org/ website has gotten a makeover, and is currently celebrating 35 years of PGP:
The original PGP 1.0 was released on June 5th, 1991.
(Version 1.x of PGP lost relevance quickly - it used a symmetric cipher that did not withstand even mild scrutiny.
The updated version 2.x series came out in 1992 and rectified this issue.)

2026-05-30 14:05:19 GMT

- reply

There is of course a human layer of "drama" to this. And man, am I tired of that as well.
But more urgently, this divergence will impact users of OpenPGP negatively - and there is no obvious straightforward solution that I can see. I'm personally much more interested in how to mitigate this issue, than the "drama" side of it.
My sense is that raising the divergence more publicly is one element of a potential solution.

2026-05-28 10:08:59 GMT

Last week, @npub1nen…n3ve published an article about the recent tenth OpenPGP email summit, co-written by @npub1nd6…t277, @npub1f96…fp0d and me.
As of today, the article is public for non-subscribers:
https://lwn.net/Articles/1072870/
It contains a high-level overview of some recent developments in the #OpenPGP ecosystem, including PQC migrations, the new "unobtrusive signatures" draft for ubiquitous email signing, the Autocrypt v2 draft for ratcheting encryption key rotation, and more.

2026-04-24 12:13:13 GMT

Regular PSA reminder:
While GnuPG 2.5.x implements hybrid PQC encryption based on ML-KEM, just like https://datatracker.ietf.org/doc/draft-ietf-openpgp-pqc/, GnuPG's implementation is entirely incompatible with the IETF-specified format, which all other libraries are implementing.
Both serialization and the KEM combiners differ.
The bottom line is that anyone who wants to use vendor-agnostic PQC with OpenPGP should *avoid GnuPG's PQC key formats*.
This is all exceedingly unfortunate and weird, and frankly, a total disgrace.

2026-03-19 17:36:59 GMT

The openpgp-card-state crate now has a new "ephemeral" backend:
https://codeberg.org/openpgp-card/state/#ephemeral-interactive-input-with-persistence-and-expiry
This combines the defensiveness of unpersisted pinentry with the convenience of caching (in the Linux kernel credential store, for a configurable duration).
New releases of https://crates.io/crates/openpgp-card-tool-git, https://crates.io/crates/openpgp-card-ssh-agent, https://crates.io/crates/rsop-oct support this new #OpenPGP card PIN storage backend.
Many thanks to @npub1r32…uqqj who implemented this new PIN handling mechanism in openpgp-card-state.

2025-11-18 12:49:04 GMT

- reply

I'm also keeping my fingers crossed for good progress on the servo front.
In the meantime, I just learned that Fedora doesn't currently package librewolf, so https://en.wikipedia.org/wiki/GNU_IceCat is the most available side-stepping option in Fedora-land.
A brief web search didn't give me a clear impression how those two forks compare. Maybe someone here has insights?

2025-09-08 11:22:35 GMT

- reply

"(Which, honestly, isn't very fair, since I'm not ICE.)"
lol

2025-08-15 20:03:08 GMT

- reply

what services do you want to authenticate against?
The onlykey is unfortunately not following the OpenPGP card specification, but instead its pgp functionality is tightly coupled with the GnuPG software.
So that device sadly won't work with the oct family of tools.

2025-08-03 18:36:56 GMT

- reply

I'll try to take a serious look and think sometime next week!
In the meantime, I'm excited to see you experiment. That in itself feels like a great success for these tools - inviting and enabling experimentation ☺️

2025-08-03 18:31:25 GMT

- reply

I just saw the notification email!

2025-06-28 17:11:56 GMT

- reply

very cool to hear of successful FreeBSD usage of both tools! 🥳

2025-05-19 01:32:22 GMT

I'm launching a new site about #OpenPGP:
https://openpgp.foo/
This site is a personal writing project with a focus on learning OpenPGP's concepts by playful hands-on use.
My goal is to empower readers to make sense of more advanced material (including https://openpgp.dev/), and become proficient in whatever subset of OpenPGP they are interested in.
The site is far from complete, I hope to continue writing on it. Let me know what you think, and what additional content you'd like to see!