new | show | ask | jobs Github

Thom2000 3 days ago

> PGP supports RSA. That's enough reason to avoid it.

I hate to break the narrative but age also supports RSA, for SSH compat:

https://man.archlinux.org/man/age.1#SSH_keys

▲

some_furry 3 days ago | parent [-]

That's only because SSH supports RSA. Mainstream usage of age with age public keys only supports X25519.

▲

akerl_ 3 days ago | parent [-]

Eh. You don't really get to do this sleight of hand. If you're gonna rag on RSA support as a shibboleth for bad design, it's bad for GPG and bad for age. If it's direct evidence of bad design, age shouldn't have permitted it via their SSH key support.

▲

some_furry 3 days ago | parent [-]

I agree in principle, but I'm not looking at "what SSH dragged in". I'm looking at age as a pure isolated thing, according to the spec: https://github.com/C2SP/C2SP/blob/main/age.md

This transparency keyserver actually gives us an excellent opportunity to measure how many people use Curve25519 vs RSA, even with SSH support.

We should contrast this with actively valid public keys on a PGP keyserver in 2026 and see which uses modern crypto more. The results probably won't be surprising ;)

▲

akerl_ 2 days ago | parent [-]

Those goalposts are really agile.

We've moved from "PGP supports RSA. That's enough reason to avoid it." to "We should contrast this with actively valid public keys on a PGP keyserver in 2026 and see which uses modern crypto more".

	▲	some_furry a day ago \| parent [-]
		We aren't having the same discussion in both places, so no, it's not a fucking goalpost.