Subject: Re: Resolution on large-block ciphers (e.g., TWOFISH), PGP7

From: "Michael Young" <[email-masked]>
Date: Mon, 17 Jul 2000 08:30:50 -0400

Yes, I meant Twofish, not Blowfish.

The draft I found at imc.org still says in section 5.5.3:
>     - [Optional] If secret data is encrypted, eight-octet Initial
>       Vector (IV).

This should now read "an IV of the same length as the cipher block"?

[Is there a more recent draft than that posted at imc.org?  That one
claims to expire June 2000.]

As Werner Koch pointed out last year, this will require an implementation
to know the block size simply in order to parse the rest of the packet.
Given that the only material after the IV is the encrypted part, and thus
won't be readable anyway without support for that cipher, I suppose this
isn't all that serious.  But is there any intention to make the IV size
self-describing for future ciphers, or is this the final plan?

Thanks for the quick responses.

---

From: Werner Koch <[email-masked]>
Date: Mon, 17 Jul 2000 15:48:33 +0200

> This should now read "an IV of the same length as the cipher block"?

5.7. got it right.

  Werner

-- 
Werner Koch				OpenPGP key 621CC013
OpenIT GmbH                             http://www.OpenIT.de

---

From: Paul Koning <[email-masked]>
Date: Mon, 17 Jul 2000 09:54:44 -0400 (EDT)

>>>>> "Michael" == Michael Young <[email-masked]> writes:

 Michael> Yes, I meant Twofish, not Blowfish.  The draft I found at
 >> - [Optional] If secret data is encrypted, eight-octet Initial

 Michael> This should now read "an IV of the same length as the cipher
 Michael> block"?

Clearly yes.  The IV always must be the same size as the blocksize for
any block cipher.

 Michael> As Werner Koch pointed out last year, this will require an
 Michael> implementation to know the block size simply in order to
 Michael> parse the rest of the packet.  Given that the only material
 Michael> after the IV is the encrypted part, and thus won't be
 Michael> readable anyway without support for that cipher, I suppose
 Michael> this isn't all that serious.  But is there any intention to
 Michael> make the IV size self-describing for future ciphers, or is
 Michael> this the final plan?

Can't see any reason to change that.  You only need to know the IV if
you're going to decrypt.  And to do that clearly you must know the
cipher, which includes knowing its blocksize.

If you're not going to decrypt, you might as well consider the IV as
part of the encrypted message, since it doesn't contain any
interesting information.

      paul

---

From: Jon Callas <[email-masked]>
Date: Mon, 17 Jul 2000 17:21:28 -0700

>This should now read "an IV of the same length as the cipher block"?

Fixed.

	Jon