Hi, Some time ago I've done attempts of packages for svgalib on yodl, before this I didn't really have a need for pgp, so I didn't use gpg. I've done a few (signed) test releases of packages for svgalib and yodl, but those got stuck in the QA queue. After this I turned my attention to some other projects (xmame mainly). Then some time ago I decided that I wanted to try again to get those package through the QA queue, and ... oops I forgot my gpg password :| See I thought, hmm this is going to be an important password letts think up a new one (mistake!), used it a couple of times then didn't use it for a few months and now BUMMER!

Seeing how Fedora-Extras is really shaping up now I really would like to become an active community member (not a good start this) and do some packaging. Now I've already submitted my gpg key to: pgp.mit.edu. I could ofcourse just nuke my current .gpg dir and start from scratch since not many people have my public key already, but then my old key would still be registered at pgp.mit.edu . The faq at pgp.mit.edu also doesn't make me happy (at all) anything I can do? I'm already quite embaressed about this as it is, so no that is SO stupid replies please. Thanks & Regards, Hans

tor, 16.12.2004 kl. 21.23 skrev Hans de Goede: > Hi, > > Some time ago I've done attempts of packages for svgalib on yodl, before > this I didn't really have a need for pgp, so I didn't use gpg. I've done > a few (signed) test releases of packages for svgalib and yodl, but those > got stuck in the QA queue. After this I turned my attention to some > other projects (xmame mainly). > > Then some time ago I decided that I wanted to try again to get those > package through the QA queue, and ... oops I forgot my gpg password :| > > See I thought, hmm this is going to be an important password letts think > up a new one (mistake!), used it a couple of times then didn't use it > for a few months and now BUMMER! > sounds familiar > Seeing how Fedora-Extras is really shaping up now I really would like to > become an active community member (not a good start this) and do some > packaging. > > Now I've already submitted my gpg key to: pgp.mit.edu. > I could ofcourse just nuke my current .gpg dir and start from scratch > since not many people have my public key already, but then my old key > would still be registered at pgp.mit.edu . > > The faq at pgp.mit.edu also doesn't make me happy (at all) anything I > can do? > > I'm already quite embaressed about this as it is, so no that is SO > stupid replies please. > > Thanks & Regards, > > Hans I'm in the same pos, only nobody exept RH translation project know about my key...

Maybe the new dual Opteron box I just ordered can crack the passwords for both our keys. ;-)

> The program could try over 600 combinations a second on a 2-3yo Athlon > giving almost 5 digits tested per day if you only use lower-case and > digits. This means that a pass-phrase of 6 characters comprising > lower-case and digits could be reliably cracked in just over a month. 7 > characters could be done in 3 years with an old Athlon or maybe some > reasonable amount of time in a dual-Opteron. 8 or more characters would > require a large network of machines. > > Let me know if you want a copy of my code, but be warned, it's really > ugly. Also it might be possible to optimise things and maybe double the > speed if you can figure out GPG memory management (I can't). 1) Thanks, but I finally remembered my password 2) This is worry some, so a passphrase really should be 8 chars minimal?

man, 27.12.2004 kl. 18.01 skrev Russell Coker: > On Friday 17 December 2004 08:19, Paul Iadonisi <pri.rhl3(a)iadonisi.to&gt;

> > Maybe the new dual Opteron box I just ordered can crack the passwords > > for both our keys. ;-) > > I wrote a program to crack keys with a hacked version of gpg (at the > point in the code where it asks for the pass-phrase my code inserted a > loop to go through the passwords). It's ugly but with the recent > versions of gpg it works reasonably well (I discovered a memory leak > whereby gpg would lose a couple of hundred bytes every attempt at a > pass-phrase). What if it tried a dictionary first?