Mailing List Archive: GnuPG: devel

AGP on Android

Index | Next | Previous | View Threaded

bernhard at intevation

Aug 16, 2010, 8:46 AM

Post #1 of 13 (3149 views)
Permalink

AGP on Android

On Android there is something called android-privacy-guard, AGP.

http://www.thialfihar.org/projects/apg
http://code.google.com/p/android-privacy-guard/

useful for the key management and gui stuff I guess,
also they integrate deprecated non-MIME OpenPGP signing and encryption
to k9mail. (http://code.google.com/p/k9mail/wiki/ReleaseNotes)

Looks like they are using the Bounty Castle Crypto Java implementation.
The more end-to-end email security there is, the better,
so it is cool to see it around! :)

I just wondered: Could GnuPG run on Android? Did someone try?

Best,
Bernhard

--
Managing Director - Owner: www.intevation.net (Free Software Company)
Deputy Coordinator Germany: fsfe.org. Board member: www.kolabsys.com.
Intevation GmbH, Osnabrück, DE; Amtsgericht Osnabrück, HRB 18998
Geschäftsführer Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner

Attachments:

signature.asc (0.19 KB)

rjh at sixdemonbag

Aug 16, 2010, 9:05 AM

Post #2 of 13 (3132 views)
Permalink

Re: AGP on Android [In reply to]

On 8/16/10 11:46 AM, Bernhard Reiter wrote:
> I just wondered: Could GnuPG run on Android? Did someone try?

Android is fundamentally a really hacked-upon Linux kernel with some GNU
userland and the Android stack. There's no reason to think GnuPG
couldn't be ported fairly easily, especially if you're willing to reduce
the feature set as far as possible. This is not the same thing as
saying it would be wise: there are some good reasons to be skeptical of
OpenPGP on mobile devices.

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

rich at anomos

Aug 16, 2010, 9:41 AM

Post #3 of 13 (3127 views)
Permalink

Re: AGP on Android [In reply to]

I've ported GPG to Android! It works pretty well, I was working on a privacy
app for Android that I had to put on the back burner, but the binary works
okay. Hopefully I'll release the full app in about a month and a half-ish
(it's a crypto + stegonographic project). APG is actually pretty good
though, just a little slow last time I used it.

R

On Mon, Aug 16, 2010 at 12:05 PM, Robert J. Hansen <rjh [at] sixdemonbag>wrote:

> On 8/16/10 11:46 AM, Bernhard Reiter wrote:
> > I just wondered: Could GnuPG run on Android? Did someone try?
>
> Android is fundamentally a really hacked-upon Linux kernel with some GNU
> userland and the Android stack. There's no reason to think GnuPG
> couldn't be ported fairly easily, especially if you're willing to reduce
> the feature set as far as possible. This is not the same thing as
> saying it would be wise: there are some good reasons to be skeptical of
> OpenPGP on mobile devices.
>
> _______________________________________________
> Gnupg-devel mailing list
> Gnupg-devel [at] gnupg
> http://lists.gnupg.org/mailman/listinfo/gnupg-devel
>

buanzo at buanzo

Aug 16, 2010, 9:59 AM

Post #4 of 13 (3135 views)
Permalink

Re: AGP on Android [In reply to]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 08/16/2010 01:05 PM, Robert J. Hansen wrote:
> This is not the same thing as saying it would be wise: there are some good reasons to be skeptical of
> OpenPGP on mobile devices.

Hi Robert,

Would you care to elaborate on that?

Yours,

- --
Arturo "Buanzo" Busleiman
Independent Linux and Security Consultant - OWASP - SANS - OISSG .
http://www.buanzo.com.ar/pro/eng.html ..:
http://www.cervezacicuta.com.ar - "LA" Cerveza Artesanal de Villa Bosch
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEAREKAAYFAkxpbncACgkQAlpOsGhXcE1jHACfYJUoM8pk5lZ4nnXaYubzP5ZS
RMQAnR2kxWNyMgMAFWvNUCvm2mqKxxjI
=0oFo
-----END PGP SIGNATURE-----

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

rjh at sixdemonbag

Aug 16, 2010, 12:20 PM

Post #5 of 13 (3126 views)
Permalink

Re: AGP on Android [In reply to]

On 8/16/2010 12:59 PM, Arturo 'Buanzo' Busleiman wrote:
> Would you care to elaborate on that?

People play MP3s on their three-year-old smartphones and they don't want
to have to stop listening to their music just because they get an
encrypted email. That means their 400MHz ARM processor is already
running close to 100% CPU usage between codecs and background apps. Now
introduce CPU-intensive asymmetric crypto into the mix, and...

It is challenging to give users a satisfactory experience when (a) the
email has to decrypt and render in under a second, (b) you're not
allowed to make their MP3 playback skip, and (c) you're supporting
ridiculously large keysizes (4K RSA). If you want all three of those,
your work's cut out for you.

In time, OpenPGP will come out with a mobile profile that's meant to
work better in these environments. In time, people will also buy new,
more capable, smartphones. The problems that I'm talking about are only
problems right now -- I don't want to give the impression they're permanent.

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

gnupg at oneiroi

Aug 16, 2010, 12:52 PM

Post #6 of 13 (3137 views)
Permalink

Re: AGP on Android [In reply to]

Hello.

On 08/16/2010 09:20 PM, Robert J. Hansen wrote:
> On 8/16/2010 12:59 PM, Arturo 'Buanzo' Busleiman wrote:
>> Would you care to elaborate on that?
>
> People play MP3s on their three-year-old smartphones and they don't want
> to have to stop listening to their music just because they get an
> encrypted email. That means their 400MHz ARM processor is already
> running close to 100% CPU usage between codecs and background apps. Now
> introduce CPU-intensive asymmetric crypto into the mix, and...
>
> It is challenging to give users a satisfactory experience when (a) the
> email has to decrypt and render in under a second, (b) you're not
> allowed to make their MP3 playback skip, and (c) you're supporting
> ridiculously large keysizes (4K RSA). If you want all three of those,
> your work's cut out for you.
>
> In time, OpenPGP will come out with a mobile profile that's meant to
> work better in these environments. In time, people will also buy new,
> more capable, smartphones. The problems that I'm talking about are only
> problems right now -- I don't want to give the impression they're permanent.

I think that your impression is outdated. HTC G1 (almost three year old
phone) - when talking about raw CPU power - is as capable as Pentium
III/550 or almost as old iBook's PPC G4 (and these aren't performing
that poor you know). What's more it has cute DSP capability which can be
used in audio processing (for example) with far better results then
non-specialized chip. You missed that right now probably most of
smartphones are armed with asymmetric crypto software. Examples? TLS/SSL
when sending/getting emails or just surfing some parts of the web...

No conclusion needed here, right?

--
Regards,
Milo

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

buanzo at buanzo

Aug 16, 2010, 1:19 PM

Post #7 of 13 (3131 views)
Permalink

Re: AGP on Android [In reply to]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 08/16/2010 04:20 PM, Robert J. Hansen wrote:
> In time, OpenPGP will come out with a mobile profile that's meant to
> work better in these environments. In time, people will also buy new,
> more capable, smartphones. The problems that I'm talking about are only
> problems right now -- I don't want to give the impression they're permanent.

Well, we fully agree then. With the above clarification on time-dependancy, that is.

Thank you for your time.

- --
Arturo "Buanzo" Busleiman
Independent Linux and Security Consultant - OWASP - SANS - OISSG .
http://www.buanzo.com.ar/pro/eng.html ..:
http://www.cervezacicuta.com.ar - "LA" Cerveza Artesanal de Villa Bosch
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEAREKAAYFAkxpnVAACgkQAlpOsGhXcE0UugCeL9YAHPZQbbmABUmviRN4ilIy
5+oAn000k2HBF3wa56rMkNtbXoENrN/b
=wKFX
-----END PGP SIGNATURE-----

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

rjh at sixdemonbag

Aug 16, 2010, 2:13 PM

Post #8 of 13 (3131 views)
Permalink

Re: AGP on Android [In reply to]

On 8/16/2010 3:52 PM, Milo wrote:
> No conclusion needed here, right?

The HTC G1 isn't the three-year-old handheld I'm thinking of. I'm
thinking of bargain basement Windows Mobile devices that were given away
for free with contract signups. I'm also thinking of el-cheapo
handhelds sold in the developing world, which in order to keep prices
down skip such niceties as DSPs.

Are there three-year-old handhelds that can do the job? Sure. Is it
reasonable to think _most_ three-year-old handhelds can do the job?
That seems like a bold claim. I'll need to see supporting evidence.

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

gnupg at oneiroi

Aug 16, 2010, 2:52 PM

Post #9 of 13 (3129 views)
Permalink

Re: AGP on Android [In reply to]

On 08/16/2010 11:13 PM, Robert J. Hansen wrote:
> On 8/16/2010 3:52 PM, Milo wrote:
>> No conclusion needed here, right?
>
> The HTC G1 isn't the three-year-old handheld I'm thinking of. I'm
> thinking of bargain basement Windows Mobile devices that were given away
> for free with contract signups. I'm also thinking of el-cheapo
> handhelds sold in the developing world, which in order to keep prices
> down skip such niceties as DSPs.
>
> Are there three-year-old handhelds that can do the job? Sure. Is it
> reasonable to think _most_ three-year-old handhelds can do the job?
> That seems like a bold claim. I'll need to see supporting evidence.

I'm getting your point but remember that we are talking about
Android-capable devices (well, at least this was Bernhard's point I
think) - and I bet that most of these are equal or stronger in terms of
processing power then G1 (this was first widely available Android hw
platform).

There is another thing to mention - data transmission security is
Ahillean heel of modern mobile phone networks. For couple of reasons
operators don't care or don't want to provide it (same for - all? -
mobile OSes vendors). It would be nice to push this topic further
(despite some potential difficulties - like one mentioned by you)
because not much is happening on this field.

--
Regards,
Milo

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

nathan at freitas

Aug 16, 2010, 3:10 PM

Post #10 of 13 (3134 views)
Permalink

Re: AGP on Android [In reply to]

I just wanted to jump in here, as I originally joined this list during
my own efforts port GPG to Android. I ended up deciding to support the
work of APG instead, because I felt that perhaps new implementation on
BouncyCastle was more appropriate for Android, even with the performance
hit.

As for this notion that Android is just a first world phenomenon, I can
tell you that availability of Android is growing very quickly throughout
the world, thanks in large part to many of the mobile manufacturers in
China using it it instead of their own proprietary or locally developed
mobile OSes. Growth of Android amongst middle class users in China,
India, the Middle East, and even some parts of Africa, is strong. Yes,
the $10 Nokia's and last generation WinMo phones still rule in quantity,
but Android is evolving quickly out of its early adopter, luxury phase.

On 8/16/10 5:52 PM, Milo wrote:
> There is another thing to mention - data transmission security is
> Ahillean heel of modern mobile phone networks. For couple of reasons

I am also the developer who ported Tor to Android aka "Orbot", and I can
tell you it runs great, even on a G1, while taking phone calls. We've
just quietly pushed the 1.0 release into the Android Market, so please
check it out. In addition, we have an OtRChat app which can run over
Tor, and provide encrypted XMPP, etc.

You can find out more at:
https://www.torproject.org/docs/android.html
https://guardianproject.info/apps/orbot/
https://guardianproject.info/apps/otrchat/

mobile OSes vendors). It would be nice to push this topic further
> (despite some potential difficulties - like one mentioned by you)
> because not much is happening on this field.

That's what we are doing at Guardian : https://guardianproject.info

Feel free to join our dev list or find us on #guardianproject on irc.

Best,
Nathan

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

rjh at sixdemonbag

Aug 16, 2010, 3:24 PM

Post #11 of 13 (3130 views)
Permalink

Re: AGP on Android [In reply to]

On 8/16/2010 5:52 PM, Milo wrote:
> I'm getting your point but remember that we are talking about
> Android-capable devices

You are; I'm not. I never said there was reason to be skeptical of
OpenPGP on the Android: I said there was reason to be skeptical of
OpenPGP on mobile devices. Maybe I should have made it more clear: I
thought I was being precise, but I can see how people may have missed my
shift.

I think OpenPGP in the mobile space is fascinating. OpenPGP in the
Android-specific space, or the iPhone or Pre-specific space, or
what-have-you, interests me much less.

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

jrollins at finestructure

Aug 16, 2010, 4:15 PM

Post #12 of 13 (3134 views)
Permalink

Re: AGP on Android [In reply to]

On Mon, 16 Aug 2010 17:13:26 -0400, "Robert J. Hansen" <rjh [at] sixdemonbag> wrote:
> On 8/16/2010 3:52 PM, Milo wrote:
> > No conclusion needed here, right?
>
> The HTC G1 isn't the three-year-old handheld I'm thinking of. I'm
> thinking of bargain basement Windows Mobile devices that were given away
> for free with contract signups. I'm also thinking of el-cheapo
> handhelds sold in the developing world, which in order to keep prices
> down skip such niceties as DSPs.
>
> Are there three-year-old handhelds that can do the job? Sure. Is it
> reasonable to think _most_ three-year-old handhelds can do the job?
> That seems like a bold claim. I'll need to see supporting evidence.

I think you're really jumping the gun here. If we can get even geeks to
use OpenPGP on their fancy phones we'll be doing well.

jamie.

rjh at sixdemonbag

Aug 16, 2010, 5:06 PM

Post #13 of 13 (3128 views)
Permalink

Re: AGP on Android [In reply to]

> I think you're really jumping the gun here. If we can get even geeks to
> use OpenPGP on their fancy phones we'll be doing well.

Network effects. Imagine there's a cool little communications app that only works on the Palm Pre. Nobody cares, because the Pre occupies such a tiny fragment of the market space. (Or, for the real world, Skype on the desktop is a very hot piece of technology: Skype on Droid, nobody cares. As cool as the Droid is, it's a tiny fragment, etc., etc.) By comparison, just dialing a number and talking to someone, regardless of what carrier they're on â€” that's very cool and people pay good money for it. The size of the base of users with whom you can communicate contributes in a very big way to the overall usefulness of the application.

This is all getting very far afield of the original question, though, which was whether it was possible to port GnuPG to Android. If we want to discuss this further, let's take it to -users and leave the -devel list for its intended purpose: low-volume talk about stuff directly related to GnuPG development.

_______________________________________________
Gnupg-devel mailing list
Gnupg-devel [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads