Does GrapheneOS has an official PGP Key?

Jasper82

Does GrapehenOS has an offical PGP Key to sign very important messages?

If yes: where can I find it?

If no: why not?

Novaliss

Jasper82
https://grapheneos.org/contact#contacting-the-project

GrapheneOS

Jasper82 GrapheneOS fully replaced using PGP via GPG with OpenSSH signing and age encryption. We no longer use PGP ourselves. We can decrypt an email sent to us with our legacy PGP key if necessary but we plan to stop dealing with it.

Our Git tags, install zips and attestation key fingerprints are signed with OpenSSH.

We use age to encrypt backups prior to uploading them and it can be used to send us encrypted messages, but it's better to use a proper secure messaging system. We host our own mail server so the difference from our end is whether the message is available on the server or only on local machines after fetching the emails from it.

PGP is a legacy standard with many flaws. GPG is a particularly problematic implementation with major security weaknesses. Sequoia PGP is far less bad but it's not a modern cryptographic tool. Email isn't a decent secure messaging system regardless of what's layered on top due to how much of a legacy mess it is.

Jasper82

Novaliss

The site says:
"Encryption can be performed via our age public key: age1dcftzgq00ykgwvxl5te6d5clqgx75h2g54c0u8gjc43mcnea7p7q3ma0yx."

Can this key also be used for signing?

Johnnyloans

Jasper82 Can this key also be used for signing?

No, this is for someone sending the GOS team files which could be a text file with a message.

https://github.com/FiloSottile/age

Jasper82

Johnnyloans No, this is for someone sending the GOS team files which could be a text file with a message.

https://github.com/FiloSottile/age

So this doesnt answer my questions?

AtavisticPuma

Jasper82
I think the implied answer would be "No, we agree with the goals of the age project, age encryption is better than pgp, and we would rather you use that to contact us"

AtavisticPuma

AtavisticPuma
https://moxie.org/2015/02/24/gpg-and-me.html

https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/

02673853

AtavisticPuma https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/

This doesn't seem like it can compete with the adaption and implementation of PGP/GPG.

For example: Is there any security dedicated device like a hardware wallet that can sign and verify SigStore or some other PGP/GPG competitor?

DohnJoe

02673853 For example: Is there any security dedicated device like a hardware wallet that can sign and verify SigStore or some other PGP/GPG competitor?

I am not sure if I understood correctly what you mean, but in the official SigStore's manual, under the Hardware Tokens Section, they specify that cosign supports hardware tokens for signing and key management.

Just after the explanation on how to do it, there is a list of tested devices, including:

YubiKey 5C
YuibiKey 5C Nano FIPS
YubiKey 4 Series

02673853

DohnJoe I am not sure if I understood correctly what you mean, but in the official SigStore's manual, under the Hardware Tokens Section, they specify that cosign supports hardware tokens for signing and key management.

Just after the explanation on how to do it, there is a list of tested devices, including:

YubiKey 5C
YuibiKey 5C Nano FIPS
YubiKey 4 Series

GnuPG for example is supported by Open Source hardware wallets like Trezor, so I can use Trezor to perform PGP operations

DohnJoe

02673853

I am sorry, I still fail to understand what are you asking for, maybe because I know to little about this topic.

02673853 GnuPG for example is supported by Open Source hardware wallets like Trezor, so I can use Trezor to perform PGP operations

Also YubiKey allows you to store a PGP key and use it to perform operation, but this will not be compatible with SigStore.
In my understanding, SigStore implements cosign with an alternative to the PGP ecosystem and supports also hardware devices like YubiKey.

YubiKey can store PGP keys, but I think they will not be compatible with SigStore in general.
But, you should be able to use the PIV slot for SigStore and and PGP key with other software, so you should be able to use the same device in both scenarios.

02673853

DohnJoe

Trezor (and also some other hardware wallets) support to sign stuff with GnuPG and unlike Yubikey, they have a display so you dont have to trust the host system.