Re: Modern cryptographic algorithms to netpgp, netpgpverify

--0000000000000dd4a30601f4489c
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi David,

Thanks for your mail.

To give some further background to these projects - netpgp has been in-tree
since 2008 or 2009, and is based on some older code. It uses openssl for
some functionality.

There have been 2 previous attempts to finish this project, and both have
failed (for different reasons, and I'm not willing to go into the details).

Netpgp is the older code base, and is not up to current standards, there is
a completely unnecessary json implementation in there, for example - and
the architecture of it is weird, too, I will quite happily admit - look to
its provenance for those reasons.

Netpgpverify was a from-the-ground-up rewrite in 2012 or so of simply the
verification parts, and is much better, but could still do with some TLC.

On Mon, 31 Jul 2023 at 17:46, David Dudas <[email protected]> wrote:

> I'm contacting you regarding this project
> <https://wiki.netbsd.org/projects/project/netpgpverify/>, which I found o=
n
> the NetBSD project list. I would like to work on this as a study project
> with the help of my university professor.
>

That's a great and laudable aim, but I suspect that the time for netpgp as
a whole has passed. Everything in this space (for the last 10 years or so)
has been focussing on ed25519, and the infrastructure which netpgp provides
is not up to the task. These days, cryptography needs to be small and
simple - netpgp does not provide that basis.

>
> The description is pretty straightforward and I imagine there is not much
> to say, but before starting to work on it I just wanted to ask if there i=
s
> any other information, guidelines or anything that could be useful and
> relevant. Eventually a detailed description, or pointing out some files i=
n
> the source, or really anything that might be helpful.
>

I'm quite happy to answer questions, although the SCM history should
provide you with most of the answers that you could seek. But I think the
problems are more deep-rooted than just laying some newer methods on top of
existing code.

>
> I've noticed there was another question regarding this project, without a=
ny
> response, that's why I've added some other addresses to CC and I also wou=
ld
> like to ask if there is somebody who I can contact in case of some specif=
ic
> situations, if really necessary.
>

My apologies, I missed that question.

>
> Thank you in advance,
> David Dudas
>
> --
> David-Patric DUDAS
>
> Student
>
> Informatic=C4=83 =C3=AEn limba rom=C3=A2n=C4=83 | Licen=C8=9B=C4=83, anul=
 III
>
> Facultatea de Matematic=C4=83 =C8=99i Informatic=C4=83
> 0747319234
> [email protected]
> [image: facebook] <https://www.facebook.com/DudasDawid>
>
> <
> https://www.hubspot.com/email-signature-generator?utm_source=3Dcreate-sig=
nature
> >
>

Best,
Alistair

--0000000000000dd4a30601f4489c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi David,</div><div><br></div><div>Thanks for your ma=
il.</div><div><br></div><div>To give some further background to these proje=
cts - netpgp has been in-tree since 2008 or 2009, and is based on some olde=
r code. It uses openssl for some functionality.</div><div><br></div><div>Th=
ere have been 2 previous attempts to finish this project, and both have fai=
led (for different reasons, and I&#39;m not willing to go into the details)=
.</div><div><br></div><div>Netpgp is the older code base, and is not up to =
current standards, there is a completely=C2=A0unnecessary json implementati=
on in there, for example - and the architecture of it is weird, too, I will=
 quite happily admit - look to its provenance for those reasons.</div><div>=
<br></div><div>Netpgpverify was a from-the-ground-up rewrite in 2012 or so =
of simply the verification parts, and is much better, but could still do wi=
th some TLC.</div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"=
gmail_attr">On Mon, 31 Jul 2023 at 17:46, David Dudas &lt;<a href=3D"mailto=
:[email protected]">[email protected]</a>&gt; wrote:</div><blockq=
uote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1p=
x solid rgb(204,204,204);padding-left:1ex">
I&#39;m contacting you regarding this project<br>
&lt;<a href=3D"https://wiki.netbsd.org/projects/project/netpgpverify/" rel=
=3D"noreferrer" target=3D"_blank">https://wiki.netbsd.org/projects/project/=
netpgpverify/</a>&gt;, which I found on<br>
the NetBSD project list. I would like to work on this as a study project<br=
>
with the help of my university professor.<br></blockquote><div><br></div><d=
iv>That&#39;s a great and laudable aim, but I suspect that the time for net=
pgp as a whole has passed. Everything in this space (for the last 10 years =
or so) has been focussing on ed25519, and the infrastructure which netpgp p=
rovides is not up to the task. These days, cryptography needs to be small a=
nd simple - netpgp does not provide that basis.</div><blockquote class=3D"g=
mail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204=
,204,204);padding-left:1ex">
<br>
The description is pretty straightforward and I imagine there is not much<b=
r>
to say, but before starting to work on it I just wanted to ask if there is<=
br>
any other information, guidelines or anything that could be useful and<br>
relevant. Eventually a detailed description, or pointing out some files in<=
br>
the source, or really anything that might be helpful.<br></blockquote><div>=
<br></div><div>I&#39;m quite happy to answer questions, although the SCM hi=
story should provide you with most of the answers that you could seek. But =
I think the problems are more deep-rooted than just laying some newer metho=
ds on top of existing code.=C2=A0</div><blockquote class=3D"gmail_quote" st=
yle=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padd=
ing-left:1ex">
<br>
I&#39;ve noticed there was another question regarding this project, without=
 any<br>
response, that&#39;s why I&#39;ve added some other addresses to CC and I al=
so would<br>
like to ask if there is somebody who I can contact in case of some specific=
<br>
situations, if really necessary.<br></blockquote><div><br></div><div>My apo=
logies, I missed that question.</div><blockquote class=3D"gmail_quote" styl=
e=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);paddin=
g-left:1ex">
<br>
Thank you in advance,<br>
David Dudas<br>
<br>
-- <br>
David-Patric DUDAS<br>
<br>
Student<br>
<br>
Informatic=C4=83 =C3=AEn limba rom=C3=A2n=C4=83 | Licen=C8=9B=C4=83, anul I=
II<br>
<br>
Facultatea de Matematic=C4=83 =C8=99i Informatic=C4=83<br>
0747319234<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">david.dudas03@e=
-uvt.ro</a><br>
[image: facebook] &lt;<a href=3D"https://www.facebook.com/DudasDawid" rel=
=3D"noreferrer" target=3D"_blank">https://www.facebook.com/DudasDawid</a>&g=
t;<br>
<br>
&lt;<a href=3D"https://www.hubspot.com/email-signature-generator?utm_source=
=3Dcreate-signature" rel=3D"noreferrer" target=3D"_blank">https://www.hubsp=
ot.com/email-signature-generator?utm_source=3Dcreate-signature</a>&gt;<br><=
/blockquote><div><br></div><div>Best,</div><div>Alistair=C2=A0</div></div><=
/div>

--0000000000000dd4a30601f4489c--