@hko@floss.social

Heiko @hko@floss.social · Jul 19, 2026

Replying to @hko@floss.social

As a total aside, this test-Gnuk is running on an ST-LINK v2 clone that I bought ~5 years ago when I first hacked on https://crates.io/crates/openpgp-card See https://nx3d.org/gnuk-st-link-v2/ for more.

3

1

0

Heiko @hko@floss.social · Jul 19, 2026

Replying to @hko@floss.social

The key material from RFC 9580 Appendix A.4 on my test Gnuk (https://www.fsij.org/doc-gnuk/intro.html) $ oct status OpenPGP card FFFE:57092840 Signature key: Fingerprint: 060606060606060600000000cb186c4f0609a697 Creation Time: 2022-11-30 16:08:03 UTC Algorithm: EdDSA (Ed25519) Signatures made: 3 Decryption key: Fingerprint: 06060606060606060000000012c83f1e706f6308 Creation Time: 2022-11-30 16:08:03 UTC Algorithm: ECDH (Curve25519) [..]

0

1

0

Heiko @hko@floss.social · Jul 19, 2026

Over the last half week, I've implemented very barebones #OpenPGP card support in @minipgp6@floss.social Support is limited to Ed25519 and X25519 (since that's the intersection of what minipgp supports and what current cards support). As expected, there is no fundamental obstacle that prevents use of existing OpenPGP card devices with v6 keys. #rfc9580

8

1

5

0

Heiko @hko@floss.social · Jul 02, 2026

Replying to @tante@tldr.nettime.org

@tante@tldr.nettime.org according to https://en.wikipedia.org/wiki/Electric_energy_consumption#World_electricity_consumption the global total electricity consumption is ~25.000 TWh. That would make the aggregate current usage of the big tech corporations (as shown in Ketan's second image) very roughly 1% of all of humanity's electricity use. Exponential growth continuing from currently ~1% sounds even more horrifying than what I had imagined so far. Here's hoping that this unhinged waste of energy stops sooner rather than later.

0

Heiko @hko@floss.social · Jun 08, 2026

Replying to @ell1e@hachyderm.io

@ell1e@hachyderm.io my comment contains multitudes. Including sarcasm. And doom.

0

Heiko @hko@floss.social · Jun 08, 2026

Replying to @ell1e@hachyderm.io

@ell1e@hachyderm.io I was thinking the same thing as I wrote it - but then, they have decades of experience at being a wide range of shades of evil. They probably don't need my advice.

1

0

Heiko @hko@floss.social · Jun 07, 2026

Replying to @ell1e@hachyderm.io

@ell1e@hachyderm.io "Digital Crimes" 🤦 Maybe they could also mix accusations of (cyber) "terrorism" into this matter 🤪

1

0

Heiko @hko@floss.social · May 05, 2026

Replying to @upofadown@mstdn.ca

@upofadown Schemes based on RFC 9580 are going to be quite interoperable. I'm aware of at least 7 serious independent codebases that implement RFC 9580, and almost as many mature implementations of draft-ietf-openpgp-pqc. Adding autocrypt2 to the mix is a very small additional layer on top of these already widely available building blocks. (And sure, GnuPG is doing its own thing. But that is really not very relevant to Delta Chat or its users.)

2

0

Heiko @hko@floss.social · May 02, 2026

Replying to @hko@floss.social

My current goal for #minipgp6 is to clarify the target shape for an eventual v0.1.0 release. The v0.0.x series serves strictly as a prototype. This is why v0.0.1 lives in the separate "draft" git branch. Once prototyping is complete, I will start implementing the v0.1 series from scratch, in the git "main" branch.

1

0

1

0

Heiko @hko@floss.social · May 01, 2026

Replying to @hipsterelectron@circumstances.run

@hipsterelectron once the dust around the base minipgp6 stack settles, I plan to write a convenience crate for AC2 key generation and rotation. Would love to hear your thoughts when you read the draft!

1

0

Heiko @hko@floss.social · May 01, 2026

Replying to @hko@floss.social

@hipsterelectron I have not engaged with that draft yet, but minipgp6 is conspicuously matching the algorithm requirements of the scheme 😏

1

0

Heiko @hko@floss.social · May 01, 2026

Replying to @hipsterelectron@circumstances.run

@hipsterelectron have you seen https://datatracker.ietf.org/doc/draft-autocrypt-openpgp-v2-cert/ ?

1

2

1

0

Heiko @hko@floss.social · May 01, 2026

Replying to @hipsterelectron@circumstances.run

@hipsterelectron thank you! this needs so much work still, but it's such a relief to have put this initial version out in the world! ... a very smol pgp! 🥺🔏

1

0

Heiko @hko@floss.social · May 01, 2026

I just released a first draft version of #minipgp6

@minipgp6@floss.social

minipgp6 is an intentionally small #OpenPGP library stack.
It implements v6 formats from https://www.rfc-editor.org/rfc/rfc9580 and #PQC composite key algorithms from https://datatracker.ietf.org/doc/draft-ietf-openpgp-pqc/

The complete library stack in this release adds up to ~5k LOC.
It interoperates with all modern OpenPGP libraries: https://codeberg.org/minipgp6/minipgp6#interop

A SOP CLI tool based on minipgp6 can be installed as

$ cargo install minipgp6-sop

Many thanks to @nlnet@social.nlnet.nl

18

3

15

0

Heiko @hko@floss.social · Apr 28, 2026

Replying to @thermia@sk.girlthi.ng

@thermia 🙀

1

0

Heiko @hko@floss.social · Apr 27, 2026

RE: @foss_north@fosstodon.org

Yay for @dvzrv@chaos.social 's tireless(*) work towards modernizing how OpenPGP is used in distro contexts (including in Arch Linux).

I've spent some time last year hacking on https://devblog.archlinux.page/2026/verify-arch-linux-artifacts-using-voa-openpgp/ with David, which was a great time.

VOA is the other side of the coin to Signstar - the former verifies signatures, while the latter produces them.

---

(*) Although I do suspect he might at times actually get tired, after all 🤔

6

0

7

0

Heiko @hko@floss.social · Apr 27, 2026

Replying to @annaecook@mastodon.social

@annaecook@mastodon.social

1

0

Heiko @hko@floss.social · Apr 27, 2026

Replying to @hko@floss.social

A new and PQC-relevant email thread: https://lists.gnupg.org/pipermail/gnupg-users/2026-April/068280.html I consider the author of that mail (@andrewg@mastodon.ie) one of the most evenhanded and patient people in PGP. He has a lot of context, both on the technical side, and regarding the social dimension. His mail hits many nails on their heads. It's unfortunate that the PQC situation in OpenPGP (or well, in GnuPG) has derailed as it has. But here we are. I'm glad Andrew is spelling out uncomfortable points. And still hopes for common ground.

3

0

1

0