The Sequoia PGP team is happy to announce the release of version 1.0 of sq. sq is a command-line tool for working with OpenPGP artifacts with a focus on usability, security, and robustness. After seven years of development, this is sq’s first stable release. A notable change for existing users of sq is that we will no longer change sq’s CLI in an incompatible manner.| Sequoia-PGP
Sequoia is a modular OpenPGP implementation in Rust.| sequoia-pgp.org
Docs Overview For end users Books sq user documentation Sequoia git man-pages sq sqv sq-git For developers Crate sequoia_openpgp Crate sequoia-net Crate sequoia-ipc Crate sequoia-autocrypt Crate sequoia-cert-store Crate sequoia-keystore Crate sequoia-wot Specs Shared OpenPGP Certificate Directory Sequoia Web of Trust Supply Chain Security for Version Control Systems| Sequoia-PGP
The Sequoia PGP team is happy to announce the preview release of version 2.0.0-alpha.0 of sequoia-openpgp. sequoia-openpgp is our low-level crate providing OpenPGP data types and associated machinery This is the first version that supports the new revision of OpenPGP specified in RFC9580 released at the end of July 2024. It is the successor of RFC4880, released in 2007. It brings new cryptographic algorithms to OpenPGP, and deprecates and outright removes old ones. Notably, it specifies AEAD,...| Sequoia-PGP
Kurz nach dem 1.0 Release von sq, schrieb mir Keywan Tonekaboni eine Mail und fragte mich, ob ich Zeit für ein kurzes Interview für den c’t Open Source Spotlight hätte. Ein paar Tage später erschien das Interview mit einer schönen Einleitung von Keywan. Leider gibt es kein Archiv also habe ich den Inhalt mit Keywans Erlaubnis hier wiedergegeben.| Sequoia-PGP
Fedora 34 was the first version of Fedora to ship Sequoia PGP back in 2021 - a lot has happened since then. In this post, I’ll cover what’s new, and provide some hints for how to get started with some of the more advanced tools.| Sequoia-PGP
Real Time Chat You can chat with us on the OFTC IRC network in #sequoia. If you are a Matrix user, you can connect to the IRC channel via an IRC bridge from your Matrix client. Please see Debian’s Wiki page for more details. Live chat is a great way to get oriented. We also use IRC for informal discussions. Issue Tracker Most technical discussions happen in an issue. If you have a concrete question, or have identified a problem, this is the preferred place to start a discussion.| Sequoia-PGP
Over the past few months, we’ve attended a number of conferences. In addition to hearing from a lot of people who had helpful feedback and fresh ideas, we’ve also held several presentations. In this post, I summarize our talks, and link to recordings when they are available. I also report on the OpenPGP Email Summit, which is a yearly gathering of some people from the OpenPGP community. (If you are interested in the so-called LibrePGP / OpenPGP schism, read on.) At the end, I list where y...| Sequoia-PGP
In a few months, we plan to release version 1.0 of sq, our primary command line interface. With version 1.0, we will commit to a long-term stable API. Ideally, that API will also be usable. Although we’ve put in a lot of time thinking about usability, we want your feedback. To this end, we’re conducting a user study.| Sequoia-PGP
Since September 2023, nearly all paid work on Sequoia has been financed by the Sovereign Tech Fund (STF). The technical focus of the award is on the maintenance and development of sq, our command-line front-end, and sequoia-openpgp, our core library. But the scope is not limited to development work: STF is also supporting our standardization work, and community outreach. In this blog post, I’ll highlight some our recent community work.| Sequoia-PGP
The Sequoia PGP project now has a bug bounty program! If you find a novel security-relevant issue in almost any of our libraries, applications, or specifications then you’ll be rewarded with up to €10,000.| Sequoia-PGP
With recent work on Sequoia sq I have focused on improving the user experience (UX) of the commandline interface (CLI) and adding new features for increased feature parity with gpg. These changes are available starting with version 0.31.0. The effort has been accompanied by a few code refactorings which touch on the subject of making the CLI more composable and safe to use in the future. This article provides an overview of the new features and improvements.| Sequoia-PGP
sq inspect can be used to identify problems with certificates: $ gpg --export 0x7C34B4E14CE4F655 | sq inspect -: OpenPGP Certificate. Fingerprint: 1745 1D0F BB5E 88F4 0AC0 08F6 7C34 B4E1 4CE4 F655 Invalid: No binding signature at time 2020-11-18T22:41:24Z Public-key algo: DSA (Digital Signature Algorithm) Public-key size: 1024 bits Creation time: 2001-08-03 17:34:53 UTC UserID: Phil Pennock [censored email address in this list post] Invalid: Policy rejected non-revocation signature (PositiveC...| Sequoia-PGP
Fedora 38 is out, and unsurprisingly it comes with a lot of shiny, new things. One especially interesting novelty for readers of this blog is that this is the first release of Fedora in which the RPM Package Manager uses Sequoia to verify packages. This blog post is the story of how that came to be.| Sequoia-PGP
I’ve just released a new version of sq, our general-purpose command-line tool for Sequoia PGP, and it’s packed full of exciting, user-visible changes. In line with our goal of providing great end-to-end authentication, this release of sq moves from working exclusively in a stateless manner to including a full PKI, and a local certificate store. It also adds a new high-level trust management interface, sq link. sq link builds on the web of trust, but uses concepts from address book managem...| Sequoia-PGP
I have recently added the ability to generate Graphviz DOT output to the Sequoia Web of Trust project. This new functionality has been released in version 0.7.0. With it, users can visually inspect an OpenPGP Web of Trust. This can provide some fascinating insights into one’s own keyring, and the relationship between OpenPGP keys involved with software projects.| Sequoia-PGP
Today is the day Sequoia’s StandardPolicy starts rejecting SHA1-based signatures by default. This change will affect existing programs based on Sequoia, as the SHA1 deprecation has been committed to and baked into the code three years ago. Therefore, all programs using sequoia-openpgp version 0.15 and up will now reject SHA1-based signatures by default.| Sequoia-PGP
We are pleased to announce the first release of the Chameleon, Sequoia’s reimplementation of the GnuPG interface. This is a technology preview, but we encourage developers who integrate GnuPG into their software to see whether it works with the Chameleon.| Sequoia-PGP
I did some user testing of sq with five volunteers. This blog post is a report of what I learned. Good news: everyone did get all the tasks done successfully and within the one hour I had allocated, with plenty of time left over. Of course, there were a few things that could be improved.| Sequoia-PGP
I will do some informal user testing of sq. In short, I will watch volunteers use sq to achieve specific tasks that I give them. The goal of this is to find out pain points when using sq: what is easy and straightforward; what is difficult to understand; what is difficult to do. The testing will cover the sq command line tool and its built-in help, but not any other manuals or materials.| Sequoia-PGP
The Sequoia command line tool sq has gained support for the sq keyring list and sq wkd url commands.| Sequoia-PGP
We are pleased to announce a new release of sq, our command line tool for OpenPGP operations. This release brings some more functionality, as well as some bug fixes. A summary of the user-visible changes from the past four months since the previous release: sq can now add and remove key User IDs. sq can now generate a subkey for authentication. sq now handles malformed certificates in a sq keyring list more gracefully.| Sequoia-PGP
The GnuPG command line tool gpg is the most popular implementation of the OpenPGP specification. The Sequoia PGP project produces the corresponding sq tool, and that tool is very much in its early stages. In the long run, we want sq to become so capable it has a comparable feature set to gpg. This blog post is a comparison of what the two tools can do.| Sequoia-PGP
We are pleased to announce a new release of the Octopus, an alternative OpenPGP backend for Thunderbird. This release notably fixes a bug that could lead to a loss of secret key material. It also includes fixes that make the Octopus compatible with Thunderbird 91.8.0.| Sequoia-PGP
We are pleased to announce a new release of the Octopus, an alternative OpenPGP backend for Thunderbird. This release brings compatibility with newer versions of Thunderbird (Thunderbird 99 and up), a few bug fixes, and some documentation improvements.| Sequoia-PGP
Would you like to use Sequoia sq from your script? We’d like your feedback. I’m sketching what the JSON output of sq might look like. We in the Sequoia project would like to make sure the JSON serves you well and is convenient for your code to consume. This blog post outlines the principles of how JSON output is meant to work, and has a concrete example of what it’s meant to look like. Your feedback would very much be appreciated.| Sequoia-PGP
Last month I was looking for volunteers to be interviewed as stakeholders for sq. The interviews happened last week and this is an anonymized summary of what I was told. I promised to make the summary anonymous to let the volunteers speak more freely.| Sequoia-PGP
The Sequoia PGP project condemns the war that the Russian government is waging against our friends in Ukraine.| Sequoia-PGP
Do you use sq or want to use it in the future? Please volunteer to help guide its development. Sequoia isn’t just a library. It just takes a library-first approach. Sequoia’s command-line interface, which exposes a lot of the library’s functionality, is called sq. It already exists in a basic form, but a lot of functionality is missing. You can help with that.| Sequoia-PGP
The NLnet Foundation has granted me funding (from the NGI Assure fund, financially supported by the European Council) to improve the Sequoia sq program in three ways. I will add important missing functionality, especially compared to GnuPG. This work will be guided by feedback from actual and potential users and the wisdom of Sequoia developers. I will also add a JSON API to allow sq to be used from scripts. Ideally, other programs would use the Sequoia library directly, however, using sq fro...| Sequoia-PGP
Over the last months we’ve worked on adding support for OpenPGP card hardware tokens to Sequoia. OpenPGP cards (like the free Gnuk implementation, or e.g. Nitrokey and YubiKey devices) are great when you want to use an OpenPGP key, but don’t want the private key material stored on your computer. Advanced OpenPGP users have come to expect their software to support them. Earlier this month, we connected a set of physical cards to our continuous integration (CI) machine and configured a job ...| Sequoia-PGP
I’m pleased to announce a new release of the Octopus, an alternative OpenPGP backend for Thunderbird. This release brings several compatibility improvements with newer versions of Thunderbird, a few bug fixes, and some documentation improvements. And, it changes the Octopus’ license from the GPL to the LGPL to be consistent with our recent relicensing of the Sequoia libraries.| Sequoia-PGP
NLnet recently held a webinar on the future of OpenPGP. The Sequoia team made five short presentations. In addition to an introduction summarizing the past, present, and future of Sequoia, we presented four of our current projects, which provide a nice cross section of our current work.| Sequoia-PGP
We’re happy to announce that we’ve changed Sequoia PGP’s license from the GPL 2+ to the more permissive LGPL 2+. Simultaneously, we’ve also released version 1.5 of the openpgp crate under these terms.| Sequoia-PGP
We’re happy to announce the release of version 1.4 of our low-level OpenPGP library. The most prominent change is the addition of a new cryptographic backend based on the RustCrypto crates.| Sequoia-PGP
The EFAIL attacks demonstrate that securing email is hard. Incautious improvements to usability can lead to critical security vulnerabilities. In the case of EFAIL, an attacker could exploit mail clients that show corrupted messages to exfiltrate a message’s plain text. Although the EFAIL researchers are measured in their response, others, like Thomas Ptacek in his widely cited articles The PGP Problem from 2019, and Stop Using Encrypted Email from 2020, are calling for people to abandon Op...| Sequoia-PGP
In 2017, Moxie Marlinspike and Trevor Perrin were awarded the The Levchin Prize for Real-World Cryptography for developing the Signal protocol. It’s a well-earned honor and I have no doubt that Signal is the best practical in-class encryption scheme for messaging that the cryptographic community knows about. But, securing communication requires more than encryption. The sender also needs to make sure the public keys that they intend to use are the right keys for the intended recipients. Thi...| Sequoia-PGP
We’re happy to announce the release of version 1.3 of our low-level OpenPGP library. For those of you following along at home, you’re probably asking what happened to 1.2. This past Sunday was PGP’s 30th birthday. To celebrate three decades of PGP, we’ve decided to skip 1.2 and directly release 1.3.| Sequoia-PGP
In a blog post that I published two weeks ago, I wrote that RNP is dangerous, because it is too easy to misuse. I also explained how we avoid those problems in Sequoia. In this blog post, I will lay out how not one, but two CVEs have since come up in Thunderbird that seem to underline that danger.| Sequoia-PGP
We are pleased to share that version 0.10.1 of OpenPGP CA has been released! This is also the first version which is available on crates.io. OpenPGP CA is a tool for administrators to create and manage a decentralized, in-house certification authority. OpenPGP CA makes it possible and easy for an organization to delegate authentication decisions to someone they can rely on, like their system administrator. And, external groups and individuals can use these CAs to authenticate certificates for...| Sequoia-PGP
I was recently talking to a Thunderbird developer about API design. In the course of that conversation, I expressed concerns about RNP, the new OpenPGP implementation that Thunderbird has recently started using in place of GnuPG. That person, skeptical about my assertion that RNP’s API needs improvement, asked “Isn’t it subjective what a better API is?” I’d agree that we don’t yet have good metrics to evaluate an API. But, I disagree that we can’t judge APIs at all. In fact, I s...| Sequoia-PGP
We are thrilled to release the first version of the Octopus, an alternate OpenPGP backend for Thunderbird built on top of Sequoia. The Octopus is a drop-in replacement for RNP, the OpenPGP library shipped with Thunderbird 78. In addition to providing all of the RNP functionality that Thunderbird uses, the Octopus also includes a number of enhancements. These fall into several categories. The Octopus restores some functionality that was present in Enigmail, but removed or has not yet been reim...| Sequoia-PGP
I gave a talk at the IETF 110 about the OpenPGP Interoperability Test Suite. Slides and recording are available. The talk introduces the OpenPGP Interoperability Test Suite, describes its benefits, how it works, how to read the test results, talks briefly about results, and how to join the effort, improve the test suite, and how to run it. Enjoy!| Sequoia-PGP
Last month we released version 1.0 of our versatile, low-level OpenPGP library, sequoia-openpgp. Now we have released the first version of sq, version 0.23, which is meant for general use.| Sequoia-PGP
Version 1.0. It’s here. After three and a half years of development, we are happy to announce the release of version 1.0 of Sequoia! The release includes the low-level crate sequoia-openpgp, and a program to verify detached signatures geared towards software distribution systems called sqv. We will support this API with security updates for at least one year. In 9 months, we will announce whether we will extend this commitment. The two main criteria will be our financial situation (please d...| Sequoia-PGP
We have just released version 0.20.0 of Sequoia. The release includes the low-level crate sequoia-openpgp, a program to verify detached signatures geared towards software distribution systems called sqv, and a commandline frontend for Sequoia implementing the Stateless OpenPGP Command Line Interface called sqop.| Sequoia-PGP
We have just released version 0.19.0 of Sequoia. The release includes the low-level crate sequoia-openpgp, a program to verify detached signatures geared towards software distribution systems called sqv, and a commandline frontend for Sequoia implementing the Stateless OpenPGP Command Line Interface called sqop.| Sequoia-PGP
We have just released version 0.18.0 of Sequoia. The release includes the low-level crate sequoia-openpgp, a program to verify detached signatures geared towards software distribution systems called sqv, and a commandline frontend for Sequoia implementing the Stateless OpenPGP Command Line Interface called sqop.| Sequoia-PGP
We have just released version 0.17.0 of Sequoia. The release includes the low-level crate sequoia-openpgp, a program to verify detached signatures geared towards software distribution systems called sqv, and a new commandline frontend for Sequoia implementing the Stateless OpenPGP Command Line Interfacesqop. While SOP is not intended for daily use, it is a good way to interact with and explore OpenPGP implementations. SOP is primarily used as abstraction in the OpenPGP interoperability test s...| Sequoia-PGP
For the past few weeks, Sequoia has been in a feature freeze as we make final preparations for the 1.0 release. This is an exciting time for us. Although there are already 1 several users of our software, we look forward to offering them a stable API, and the promise of security updates. And, we hope that a 1.0 release will generate more interest in Sequoia and, consequently, more opportunities to collaborate with other projects.| Sequoia-PGP
The problem seems basically unfixable, and oh god, of course the reason involves unmaintained academic code written in OCaml. pic.twitter.com/aScg3zns1C — Matthew Green (@matthew_d_green) June 29, 2019 That's just how it works. You don't get special treatment because you're a nice, volunteer-run project with a legacy codebase from the 90s. If you're unable to fix your issues then these things will happen. — hanno (@hanno) July 1, 2019| Sequoia-PGP
On Wednesday, Vincent launched a new key server at keys.openpgp.org! What makes this launch special is that keys.openpgp.org is running Hagrid —“The Keeper of Keys”—a new verifying key server, which is written in Rust and based on Sequoia. Even though the launch didn’t receive much media attention, 700 people have already verified their keys in the 48 hours since the announcement.| Sequoia-PGP
Our last status update was six months ago, shortly after our first preliminary release. Since then, quite a bit has happened in and around Sequoia.| Sequoia-PGP
I’d like to inform you about the recent progress on your favorite OpenPGP implementation. It has been eight weeks since I last wrote an update, and there are exciting developments to report.| Sequoia-PGP
The Sequoia team proudly presents the first release of a new, cool OpenPGP implementation. On October 16, 2017, we made the first commit to the Sequoia repository. Just over a year and a thousand commits later, Sequoia’s low-level API is nearly feature complete, and is already usable. For instance, a port of the p≡p engine to Sequoia is almost finished, and the code is significantly simpler than the version using the current OpenPGP library.| Sequoia-PGP
I’d like to inform you about the recent progress on your favorite OpenPGP implementation. It has been five weeks since I last wrote an update, and there are exciting developments to report.| Sequoia-PGP
Hey folks :) I’d like to inform you about the recent progress on your favorite OpenPGP implementation. It has been five weeks since my last report, and there are exciting developments to report.| Sequoia-PGP
Get Sequoia Sequoia is maintained in a Git repository. To clone it, do: % git clone https://gitlab.com/sequoia-pgp/sequoia.git Build Sequoia Please see here for build instructions. Get in touch If you are interested in using or developing Sequoia, please get in touch. We can be reached on our mailing list, and using IRC. To send an encrypted email to someone with a sequoia-pgp.org email address, you can lookup their OpenPGP certificate using our WKD, like so:| Sequoia-PGP
A library is only as good as its integration in downstream projects. As such, we made ease of use one of our main goals. Our first decision in this regard is our library-first approach. In contrast with other implementations, we decided to provide a library that contains all the functionality first, and a command-line frontend on top of that. The rationale is that a library offers better integration into downstream applications, and no user should be tempted to ‘shell out’ to our command-...| Sequoia-PGP
Improving the security of OpenPGP users requires more than a new implementation. Therefore, we are taking a holistic approach and are improving the ecosystem. Our efforts in this regards always start with users. We have talked extensively with users to find out what their needs are, what their workflows are, what tools they currently use, and what problems they have. We spoke to application developers, digital security trainers, administrators, people in charge of operational security, and en...| Sequoia-PGP
There are a number of projects under the Sequoia umbrella, or a somehow associated with the Sequoia project. Sequoia-PGP sequoia-openpgp OpenPGP data types and associated machinery. This crate aims to provide a complete implementation of OpenPGP as defined by RFC 4880 as well as some extensions (e.g., RFC 6637, which describes ECC cryptography for OpenPGP. There are prototypes of crates providing higher-level interfaces. Take a look at the other crates in the toplevel of the repository.| Sequoia-PGP
Sequoia focuses on security and robustness in our choice of tools, our development methodology, and feature set. At the core of our efforts lies the choice of programming language, Rust. Rust’s type system provides strong guarantees that are checked at compile time. It guarantees spatial and temporal memory safety, preventing common classes of bugs like memory leaks, use of stale pointers, out-of-bounds accesses, and race conditions. Rust also makes sure that all possible values are exhaust...| Sequoia-PGP
This documents the current status of Sequoia as of 2023-03-30 . Note: At this point, there are already several users of our software, so there is a bit of experience with it in the wild. Sequoia has not been audited yet, due to a lack of funding. Please also see the OpenPGP Interoperability Test Suite for an automated assessment of Sequoia’s and other implementations’ capabilities and how compatible they are.| Sequoia-PGP
A number of people working in the OpenPGP space are involved in the Sequoia project. Some work directly on Sequoia, some work on projects using Sequoia, some are otherwise working on improving the state of the OpenPGP ecosystem. Neal H. Walfield Neal began working on GnuPG towards the end of his PhD. After two and a half years at g10code, he joined p≡p in 2017 and co-founded the Sequoia project with Justus and Kai.| Sequoia-PGP