Libgcrypt 1.8.5

When I was looking on the GnuPG page it mentioned this update. Can this be copied over the one included with GPGWin 3.1.10?

Hi Mark,

maybe it can be copied over. The recommended way is to wait for the next Gpg4win release.
See https://wiki.gnupg.org/Gpg4win/Roadmap

Note that as far as I’ve understood the fix has a low security score, see
https://minerva.crocs.fi.muni.cz/ you would need to have a second user on the system
that can observe timing for hunderts to thousands signatures of the same message.

Best Regards,
Bernhard

Hi Bernhard,

Thanks for the explanation. I will just wait for the next release which looks like it might be released soon.

Hi,

On Thursday 24 October 2019 18:48:25 CET Forum wrote:

Thanks for the explanation. I will just wait for the next release which looks
like it might be released soon.

As a general note: It is supported updating only the GnuPG component (which includes libgcrypt) by using the “Simple installer for the current GnuPG” from:

https://gnupg.org/download/index.html

But in general better wait for Gpg4win. Our current goal is to have a new GnuPG this week and a new Gpg4win next week.

Best Regards,
Andre

Hi Andre,

Was just checking back on the status of GPG4Win update.

Thanks

Mark,
it probably still takes a few days (or weeks), you can
see plans at https://wiki.gnupg.org/Gpg4win/Roadmap

Regards,
Bernhard

Bernhard,

Thanks for the update. I will check back on that Roadmap link in a few weeks.