[Openpgp-dt] 2022-05-24 meeting notes

[Stephen Farrell <[e-mail]>]

# OpenPGP Design Team

2022-05-24

Present:

gniibe
stephen
daniel huigens
dkg
paul wouters
justus

Agenda

MRs (any that editor thinks need disussing/checks?)
https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/168
editor wasn't clear everyone agreed on this
daniel H - text tries to be less hand-wavy than existing (but leaves 
wriggle-room)
paul: what's "valid"? clarified on call
dkg: more wonders if self-sig is well defined enough ("if i decide later 
that i think it's unclear, i can create a separate MR to clarify")
daniel H: is defined elsewhere
dkg: wfm
end-result: ok to merge (done)
https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/187
justus: can't tell from FP if truncated or not, maybe offer guidance to 
only use that when needed for smart-card (and not e.g. for n/w services)
dkg: was about to add a sentence until...
oops - legacy s/w will go ahead and lookup (e.g. on keyserver) based on 
truncated fp and could be fooled
paul: maybe just leave it to implementations or the smart-card spec?
gniibe: there's an unused field CA-FPR in smart-card spec that could be 
used for v5 key FP octets (the last 12 octets anyway) - could be a 
useful trick for an update to the smart-card spec
dkg: ACTION will change to "don't store v5 fp in v4 field until you've 
read the updated smart-card spec"
once done this should be ready to merge
what to do about packets that don't match any grammar?
a related pile of MRs:
https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/191
https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/190
https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/189
https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/188
dkg reprises discusssion from (non-quorate) meeting last week
paul: sounds like there should be some sec-cons text describing the 
potential problem (that we're trying to mitigate/avoid)
on the call !190 seems like the better basis so we should close 191, 
188, 189 and proceed to get 190 to where we approve it
ACTION: dkg will provide a subsection to Security Considerations section 
about aliased ciphertext
ACTION: (all) read and improve or approve !190 before end of 26th
what steps remain before entering WG last call?
!190 and !187 as above plus another draft plus aead topic on list
We'll leave uncharted MRs open for now
daniel H: will suggest security considerations text to recommend 
including intended recipient FP to prevent surreptitious forwarding attacks
Open issues - there's a pile, many tagged already, some could lead to 
additional sec-cons
We'll treat the untagged issues as WGLC comments - we'll also add issues 
as identified during WGLC so will go back over this list later for sure
editor: will add all DT non-WG chairs as authors, paul will check with 
Jeffrey
shepherd is dkg
chairs/shepherd: send a call to list to asking about any known IPR
IETF 114 (end of July)
we do want a session, 2hrs to leave time for many WGLC issues or 
re-charter discussion if all is rosy
SF will request session
https://gitlab.com/openpgp-wg/rfc4880bis/-/issues/122 (gitlab change of 
terms)
talk about this next week, not mega-urgent
dkg asked 'em something, they want a call