Re: [Openpgp-dt] first set of PRs created from step-by-step branch

[Daniel Kahn Gillmor <[e-mail]>]

Thanks for doing this, Paul!

On Wed 2021-07-21 11:27:22 -0400, Paul Wouters wrote:

> As agreed, I've started creating branches for each topic and created
> PRs for these. I've not yet created a PR for the branch "v5-keys-aead"
> as it depends on the merge of branch "v5-keys".

With no hats on, I reviewed these branches, and i've tried to mark
things as "approved" where they seem reasonable.

I think we already have v5 keys in the draft, so i think what you are
calling "v5-keys" is actually "v5 SKESK".

As i wrote over on
https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/54, i think
the v5 SKESK and "AEAD-style" S2K #253 really depend on our AEAD
definition, and i think it'll be easier for us to have the AEAD
conversation first.

If you'd like, i can try to propose an alternate, short series that just
includes the current AEAD specification plus the AEAD-specific set of
test vectors.  If we can get consensus on that, then moving through the
v5 SKESK and #253 S2K should be simpler, bite-size pieces by comparison.

If it would be useful, i can also propose a variant of AEAD with many
fewer knobs as a comparison.  Each knob can cause negotiation failures
and deprecation difficulties, and i'm worried that the current amount of
flexibility could saddle future implementations with a lot of technical
debt.

> I've also stopped creating more branches for now, as it makes my life a
> lot easier if we first pull in the v5-keys and aead, as otherwise I'm
> just counter-massaging these branches for conflicts only to have to
> de-conflict them later on the merge again.

this makes sense, we can always review the outstanding changes in the
step-by-step branch to pull them in once we've tackled the harder stuff.


             --dkg