Subject: [openpgp] Summary of WG status

From: "brian m. carlson" <[email-masked]>
Date: Wed, 12 Jul 2017 22:38:52 +0000

Our charter includes several goals that we should accomplish.  I'm going
to summarize where we are with each of them so we can see where we need
to make progress.

If you're going to respond to one or more of these, please respond to
each one in a separate thread so that we can have a logical set of
discussions.

CFRG Curves
-----------

We've included EdDSA with Curve25519.  I'd suggest including Curve448 as
an additional option for EdDSA.  That might necessitate including
SHAKE256 limited to this purpose only.

Curve25519 is defined for ECDH.  We probably also want to consider
Curve448.  The work needed for this purpose is probably limited to
including OIDs for the curve.

AEAD Algorithms
---------------

I've submitted a proposal to use EAX for data packets, and I'll be
sending out a new draft incorporating Werner's suggestions soon.  I'd
like additional feedback on if participants think this is a useful
direction.

We probably also want to consider SKESK and secret key packets.

Must-Implement Algorithms
-------------------------

We've specified SHA2-256 as the MTI hash algorithm.  This seems
uncontroversial.

3DES is still the must-implement encryption algorithm.  AES128 seems
like the logical choice here, since it's already MTI because of ECDH.

I suggest that we make the AEAD mode, whatever we pick, mandatory as
well.

Remember here that these are the obligatory options.  Most
implementations will (and already do) implement far more algorithms, so
this is just a baseline for interoperability.

Fingerprint Mechanism
---------------------

This seems to be the most controversial.  Werner has a proposal which
garnered a lot of discussion.  While it's not everything I want, I'm
happy enough with it to accept it and move forward as a goal of getting
us to done.

If there are concrete counterproposals, I suggest including sufficient
wording that can be discussed and potentially included into the
document.
-- 
brian m. carlson / brian with sandals: Houston, Texas, US
https://www.crustytoothpaste.net/~bmc | My opinion only
OpenPGP: https://keybase.io/bk2204

---

From: Werner Koch <[email-masked]>
Date: Thu, 13 Jul 2017 09:41:25 +0200

> to summarize where we are with each of them so we can see where we need

Thanks.  In addition there are some smaller things we need to address
but these are mostly editorial and non-controversial.

Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.

---

From: Werner Koch <[email-masked]>
Date: Thu, 13 Jul 2017 09:47:00 +0200

> like the logical choice here, since it's already MTI because of ECDH.

I am fine with that choice.

There is also the suggestion to make AES-nnn mandatory and 3DES optional
when used with v5 keys.  I would be in favor of that; I don't care on
whether this is AES-128 or AES-256.

> I suggest that we make the AEAD mode, whatever we pick, mandatory as

We can only do that when used with v5 keys.  We can't do that in
general.

Salam-Shalom,

   Werner

---

From: "brian m. carlson" <[email-masked]>
Date: Fri, 14 Jul 2017 00:20:56 +0000

> whether this is AES-128 or AES-256.

I think that's a good idea.  AES-128 seems like the obvious choice to
make MTI because of ECDH, and I anticipate almost all implementations
will support AES-256 as well.

> We can only do that when used with v5 keys.  We can't do that in

Mandatory to implement, yes.  Mandatory to use, no.  We also have to
consider that someone might encrypt data to both v4 and v5 keys, in
which case they might have to fall back down to MDC.  We probably need a
feature flag for AEAD packets like we have with MDC.
-- 
brian m. carlson / brian with sandals: Houston, Texas, US
https://www.crustytoothpaste.net/~bmc | My opinion only
OpenPGP: https://keybase.io/bk2204