IETF Logo Mail Archive

Re: [openpgp] Stop dragging around old material, please!

Aron Wussler <aron@wussler.it> Mon, 14 November 2022 12:02 UTC

Return-Path: <aron@wussler.it>
X-Original-To: openpgp@ietfa.amsl.com
Delivered-To: openpgp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 97A4FC1524D0 for <openpgp@ietfa.amsl.com>; Mon, 14 Nov 2022 04:02:19 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wussler.it
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jn1Rv-ehEVI4 for <openpgp@ietfa.amsl.com>; Mon, 14 Nov 2022 04:02:13 -0800 (PST)
Received: from mail-4317.proton.ch (mail-4317.proton.ch [185.70.43.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B0714C14F735 for <openpgp@ietf.org>; Mon, 14 Nov 2022 04:02:12 -0800 (PST)
Date: Mon, 14 Nov 2022 12:02:04 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wussler.it; s=protonmail3; t=1668427330; x=1668686530; bh=J1O6km9leOdb1pwNfCA8KlY3slBrcUX7tOkmXX2mj+A=; h=Date:To:From:Cc:Subject:Message-ID:In-Reply-To:References: Feedback-ID:From:To:Cc:Date:Subject:Reply-To:Feedback-ID: Message-ID:BIMI-Selector; b=WSeUG9P2bSHZyId15PdFmtWqrmjQa1C2ZE3wn3TlR70x2acJ19StTCAqQOT4eghc1 y5+re7uzHAq5uIg2NZWeZ/f5lAVfm7F2DiLrYpjwTUy1XhzbTzqImBbOadBeo6ObPd vTcMgi7ElF0QlSTEuE1RGqJRaQzNYzs5/s/g4m+dm0WR9bHJpsxaJaYirluxMyq/cT JxjHbYiGrpSZEtFsPZp5cWbTnakEIsTZzRq297o9JUFfGeuQs6WM4Xu0/XqD9S4Kga D5veZFE13NSCeyKyHkpisyjzgOJbb4F2bIrCX9yt0d3WzlpPk/3vc3GTFABsllngqm czsvU2HkH9Xsw==
To: Rick van Rein <rick@openfortress.nl>
From: Aron Wussler <aron@wussler.it>
Cc: openpgp@ietf.org
Message-ID: <wWMnF3c6WOMjMUUUZucrAgfLyI_UyKedm_IN0UTWIfwCHbbMEbfMxojua406OjBQVJYuD9WL01RwnQbqbavko615ogOy_JfgAmeZpbZAtIQ=@wussler.it>
In-Reply-To: <20221114114225.GA1789@openfortress.nl>
References: <20221114114225.GA1789@openfortress.nl>
Feedback-ID: 10883271:user:proton
MIME-Version: 1.0
Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg="pgp-sha512"; boundary="------a89ffca3907117b23a176c04652bba49642db13b2daf7b32c21d220253d8242c"; charset="utf-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/openpgp/59IzdO84iAzXeQ2ZwIFZhrbVv1k>
Subject: Re: [openpgp] Stop dragging around old material, please!
X-BeenThere: openpgp@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "Ongoing discussion of OpenPGP issues." <openpgp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/openpgp>, <mailto:openpgp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/openpgp/>
List-Post: <mailto:openpgp@ietf.org>
List-Help: <mailto:openpgp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/openpgp>, <mailto:openpgp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 14 Nov 2022 12:02:19 -0000

Hi Rick,

Unfortunately I think that we'll have to support v4 packets for a long while, and having a single reference RFC is a good way forward.
Creating a compliant implementation will be much harder having 2 specs to follow, with one partly overriding the previous. I personally support this RFC to fully obsolete RFC4880 and RFC6637, and at the same time properly define Curve25519.

> Is there any use of old packet formats that uses crypto that we would still consider healthy today?
Probably we'll have to accept v4 packets (PKESK, keys, sigs, ...) for years, not mentioning them is like hiding the complexity under the rug. Also re-specifying v4 gives the chance to change some inner mechanisms (e.g. "An implementation MUST NOT sign or verify using DSA keys" or similarly SHA-1 signatures).
V3 packets were dropped, because it was an option. V4, not so much.


Cheers,
Aron

--
Aron Wussler
Sent with ProtonMail, OpenPGP key 0x7E6761563EFE3930



------- Original Message -------
On Monday, November 14th, 2022 at 12:42, Rick van Rein <rick@openfortress.nl> wrote:


> Hello,
> 

> At IETF 115 I offered to proof-read the draft for this WG.
> Back then, I thought the old formats were finally being
> ditched, something I already fought for during RFC 4880.
> 

> Now I find that it's being renamed to Legacy. I think this
> is a mistake, but I understand the scare of making choices.
> 

> Question:
> Is there any use of old packet formats that uses crypto
> that we would still consider healthy today? None of the
> signatures would now be reliable, but the encryption may
> have protected us during transit back then, but not when
> our email boxes get broken.
> 

> Suggestion:
> There is an option to simply STOP MENTIONING old formats,
> and relying on registries that continue to allocate their
> tags. The old format was specified in older RFCs and can
> still be added to software that wants to be compliant with
> old forms, even when they are deprecated or obsoleted.
> 

> 

> Thanks,
> -Rick
> 

> _______________________________________________
> openpgp mailing list
> openpgp@ietf.org
> https://www.ietf.org/mailman/listinfo/openpgp

v2.23.0 | Report a Bug | By Email