Subject: Re: [openpgp] Stateless OpenPGP command line interface proposal

From: iang <[email-masked]>
Date: Mon, 2 Dec 2019 23:58:25 +0200

On 28/10/2019 22:40, Santiago Torres-Arias wrote:
> On Mon, Oct 28, 2019 at 04:20:39PM -0400, Daniel Kahn Gillmor wrote:
>> Hi OpenPGP folks--
>>
>> The recently-announced OpenPGP test suite [0] inspired me to try
>> drafting a spec for a purely-functional, stateless OpenPGP command line
>> interface.  The idea is that different implementers could provide the
>> same interface, focusing specifically on the object security aspect of
>> OpenPGP (leaving aside identity management).
>> ...
> I think this is a *phenomenal* idea. I wonder if this could mature in a
> well-defined API that e.g., gpgme could adopt?

Concur!

iang

---

From: Wyllys Ingersoll <[email-masked]>
Date: Mon, 2 Dec 2019 17:27:09 -0500

Does anyone have a good estimate of how many command-line oriented OpenPGP
applications are actually in use beyond GnuPG? Im really just curious, I
was under the impression that GnuPG is sort of the de-facto standard
implementation for the majority of OpenPGP users on a computer with a
keyboard.  I know there are implementations for a variety of other
languages, but I wonder if they have significantly motivated development
teams that would take this on and implement it in practice. Has the GnuPG
team indicated an interest in writing an entirely new CLI ?  For mobile
applications and other OpenPGP implementations that do not even have a CLI
this is obviously not going to be of interest, but I understand that that's
not the target audience for this sort of document anyway.

Im not trying to throw cold water on the efforts to standardize a more
friendly interface on an increasingly complicated protocol, I just wonder
how far it will go beyond becoming an interesting specification.

-Wyllys Ingersoll

On Mon, Dec 2, 2019 at 4:58 PM iang <[email-masked]> wrote:

> _______________________________________________
> openpgp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/openpgp
>

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Mon, 02 Dec 2019 20:06:37 -0500

Hi Wyllys--

On Mon 2019-12-02 17:27:09 -0500, Wyllys Ingersoll wrote:
> applications are actually in use beyond GnuPG?

In practice today, GnuPG is certainly the standard.  But rnp (from
Ribose) and sq (from Sequoia) are two other CLI OpenPGP mechanisms; and
hopenpgp-tools 0.22 implements a piece of sop already (as "hop").  And
i've been working on a command-line interface in python based on PGPy as
well.  Maybe there are others?  I don't know whether anyone has built a
CLI tool atop (for example) OpenPGP.js.

But if you look at the design of sop, it's also intended to hint at an
underlying API that doesn't need to be strictly CLI-driven.  As
https://tools.ietf.org/id/draft-dkg-openpgp-stateless-cli-01.html says:

     While this document identifies a command-line interface, the rough
     outlines of this interface should also be amenable to relatively
     straightforward library implementations in different languages.

If an OpenPGP toolkit can orient itself toward making a simple CLI
interface like sop, it will hopefully also be able to provide an
idiomatic library interface that aligns pretty closely with the same
simplifications.

But even if this proposal doesn't end up being explicitly functional in
applications, it still represents a useful frame for an interoperability
test suite, which is useful in terms of ensuring that we can upgrade the
ecosystem.

So, i think your question is a good one, but i hope that people can see
this effort as a useful stepping stone toward a healthier OpenPGP
ecosystem more generally.

     --dkg

PS as far as GnuPG goes, note that more than half of the gpg
   command-line interface surface complexity is devoted to key
   management, none of which is exposed in sop.  I hope people don't see
   sop as a replacement for all of that stuff!

---

From: Peter Gutmann <[email-masked]>
Date: Tue, 3 Dec 2019 08:05:55 +0000

Daniel Kahn Gillmor <[email-masked]> writes:

>Maybe there are others?

I threw together a quick command-line en/decrypt tool as a CLI wrapper around
the cryptlib API when I got frustrated with how complex GPG was to use, so
there's at least one more, built purely as a CLI-around-an-API app.

Peter.

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Tue, 03 Dec 2019 15:47:09 -0500

> there's at least one more, built purely as a CLI-around-an-API app.

Thanks for the observation, Peter.  Does this have a name, or published
documentation someplace?  A direct pointer would be helpful!

      --dkg

---

From: Peter Gutmann <[email-masked]>
Date: Thu, 5 Dec 2019 00:01:09 +0000

>documentation someplace?  A direct pointer would be helpful!

It doesn't really have a name (I just called the binaries "pgpencrypt" and
"pgpdecrypt") or even a public presence, it's just a quick wrapper for a
handful of library calls.  I commented on it to point out that you can turn a
library/API into a CLI application with very little work, since the topic of
building an app from an API had come up.

Peter.