Subject: Re: Another draft is going out

From: Jon Callas <[email-masked]>
Date: Wed, 11 Oct 2000 00:07:43 -0700

I forgot to mention that there's also the notation data namespace thing in
there, too. Let me know what you think.

	Jon

---

From: Werner Koch <[email-masked]>
Date: Wed, 11 Oct 2000 11:25:52 +0200

Hi,

now that it has been decided on AES I suggest to change:

9.2. Symmetric Key Algorithms
[...] 
"Implementations MUST implement Triple-DES. Implementations SHOULD
implement IDEA and CAST5.  Implementations MAY implement any other
algorithm."

by

"Implementations MUST implement Triple-DES. Implementations SHOULD
implement CAST5 and AES 128bit.  Implementations MAY implement any other
algorithm.  To allow backward compatibilty with PGP2 IDEA SHOULD be
implemented."

I dropped IDEA because I don't see a reason to support that patented
algorithm anymore - now that there is another well analyzed new
algorithm available.  

Another point:

If the use of the MDC packet is not required for at least the modern
ciphers (w/o the feature packet), we should at least add a note that
"An implementation SHOULD issue a warning if one of the new[1] cipher
algorithms is used without the MDC packet".  

[1] new:  Either explictly list old algorithms or say that new
algorithms are those with a blocklength other than 64 bit.

  Werner

-- 
Werner Koch				GnuPG key:  621CC013
OpenIT GmbH                             http://www.OpenIT.de

---

From: Thomas Roessler <[email-masked]>
Date: Wed, 11 Oct 2000 12:27:39 +0200

On 2000-10-11 11:25:52 +0200, Werner Koch wrote:

> I dropped IDEA because I don't see a reason to support that
> patented algorithm anymore - now that there is another well
> analyzed new algorithm available.

We don't need to add still more interoperability nightmares with the
old implementations which are still in use at some places.  The
text-mode signature problems are bad enough already.

-- 
Thomas Roessler                         <[email-masked]>

---

From: Jon Callas <[email-masked]>
Date: Wed, 11 Oct 2000 11:52:41 -0700

>text-mode signature problems are bad enough already.

Sooner or later, we should start encouraging people away from PGP 2.

I like what Werner said -- he simply explicitly called out that IDEA is
needed for PGP 2 support.

The subtle, lovely thing about SHOULD is that SHOULD means "if you don't
understand the ramifications, do it." It allows anyone to say "I know what
I'm doing."

However, I like the idea of calling out that IDEA is there for backwards
compatibility. How about this paragraph:

---

Implementations MUST implement Triple-DES. Implementations SHOULD implement
AES-128 and CAST5. Implementations that interoperate with PGP 2.6 or
earlier need to support IDEA, as that is the only symmetric cipher those
versions use. Implementations MAY implement any other algorithm.

---

	Jon

---

From: Jon Callas <[email-masked]>
Date: Wed, 11 Oct 2000 11:59:53 -0700

>algorithms are those with a blocklength other than 64 bit.

I don't think that tying MDC and big blocks is a good idea -- in the spec.

I think it is perfectly fine for you implementers to do that. The spec
gives you a lot of latitude, and if you want to only use a big block with
MDCs, that's fine. You need to *decrypt* one, but you don't ever have to
encrypt one. And you're perfectly within your rights to issue warning
messages if you think it's not a good idea.

If you want to limit use more, I have a suggestion: we put in a "feature"
of 128-bit-block ciphers. That way you can declare whether you use them or
not.

	Jon

---

From: Werner Koch <[email-masked]>
Date: Thu, 12 Oct 2000 11:40:02 +0200

> I don't think that tying MDC and big blocks is a good idea -- in the spec.

The idea established at the time we introduced Twofish and talked
about MDC.  I suggested to wait with Twofish until we worked out the
MDC stuff.  Anyway, the specs are getting more and more complex, so
we better don't do what I suggested.

> of 128-bit-block ciphers. That way you can declare whether you use them or

Too complicated.  We already have the preferences and issue a
warning when a received message is not encrypted by an algorithm
listed in the preferences.  So we can have the same effect by
setting up the preferences right and issue a warning when the MUST
algorithm 3DES has been used without MDC.

  Werner