Offer alternative to GPG: Minisign

[rugk]

PGP/GPG is old and uses RSA keys. There is a new signing tool called Minisign, which is faster and more secure than RSA keys as it uses the well-known elliptical curve Curve25519 included in Ed25519.

It would be nice if Minisign signatures would be offered as an alternative to traditional signatures on the download page of Qubes OS. Additionally, of course, minisign could also be used by Qubes OS internally, e.g. as a ('n additional) verification of updates or similar things...

[andrewdavidwong]

I think this is unlikely to happen for several reasons:

• PGP is a well-known, widely accepted standard.
• We also provide cryptographic digests (hashes) as an alternative verification method.
• GPG is well-tested and trusted software, whereas Minisign is relatively unknown.
• We couldn't possibly support everyone's favorite verification method. There are too many out there. We don't have the resources to evaluate them, and it probably wouldn't be worth our time.
• GPG already supports ECC.

CC: @rootkovska, @marmarek

[andrewdavidwong]

I think this is unlikely to happen for several reasons:

• PGP is a well-known, widely accepted standard.
• We also provide cryptographic digests (hashes) as an alternative verification method.
• GPG is well-tested and trusted software, whereas Minisign is relatively unknown.
• We couldn't possibly support everyone's favorite verification method. There are too many out there. We don't have the resources to evaluate them, and it probably wouldn't be worth our time.
• GPG already supports ECC.

CC: @rootkovska, @marmarek

[rugk]

/cc @jedisct1 Wanna convince them of your software? /cc @bitbeans

[rugk]

/cc @jedisct1 Wanna convince them of your software? /cc @bitbeans

[jedisct1]

If it works, don't fix it.

[jedisct1]

If it works, don't fix it.

[rugk]

It should be an alternative. That's no fix, that's an enhancement.

[rugk]

It should be an alternative. That's no fix, that's an enhancement.