Re: [openpgp] [RFC4880bis PATCH] Drop "Compatibility Profiles" section.

Daniel Kahn Gillmor <dkg@fifthhorseman.net> Thu, 25 March 2021 19:27 UTC

Return-Path: <dkg@fifthhorseman.net>
X-Original-To: openpgp@ietfa.amsl.com
Delivered-To: openpgp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF4F73A2ABC for <openpgp@ietfa.amsl.com>; Thu, 25 Mar 2021 12:27:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=fifthhorseman.net header.b=+CDPlywl; dkim=pass (2048-bit key) header.d=fifthhorseman.net header.b=A3RRlUFA
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qoO-zTFb8wZ0 for <openpgp@ietfa.amsl.com>; Thu, 25 Mar 2021 12:27:22 -0700 (PDT)
Received: from che.mayfirst.org (che.mayfirst.org [IPv6:2001:470:1:116::7]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4D4BC3A2ABA for <openpgp@ietf.org>; Thu, 25 Mar 2021 12:27:22 -0700 (PDT)
DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/simple; d=fifthhorseman.net; i=@fifthhorseman.net; q=dns/txt; s=2019; t=1616700438; h=from : to : subject : in-reply-to : references : date : message-id : mime-version : content-type : from; bh=yftadXO+5kDKBppsTY56lzFd+MMds4XNkedSVmsfXOw=; b=+CDPlywlTHIfbzZypTCNbIObtFntMU2/2DXGoEKN5CYuyzjpRG88MwyG4/WvJVMooPX1Q M84qHo3SVjeCua4Bg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=fifthhorseman.net; i=@fifthhorseman.net; q=dns/txt; s=2019rsa; t=1616700438; h=from : to : subject : in-reply-to : references : date : message-id : mime-version : content-type : from; bh=yftadXO+5kDKBppsTY56lzFd+MMds4XNkedSVmsfXOw=; b=A3RRlUFAqTQt7MXPOSAluEB6FmbOO6lPIaK1Xlo28CzxNrmAJBAA5IggwDZhmocLpD5H9 iiZeAtXUNyDY2HyMrqZZVSO0RnDFepkcTgPH7OXdCRCe1vgJMo9ApflQ+c2grO70bl/t2nF nZDlpeajsfm5e0fwmkpHw/8bDKwVD36AO/A4jznkLuStYTzDnbL54s2sZ3/ClMvzr3qgSVG aA9kiBNjoZbjaZKyQ1vxYaZB4XHou+afLz7imgQqjnr1+I3FSoZzbyUg4rd2aEBmSLsNKz5 nEdzJNMC1vsR1VuBK0LOp3MRvPGVtTE+4FGrmFkFskrv/siO5LJeQaFPatqA==
Received: from fifthhorseman.net (unknown [IPv6:2001:470:1f07:60d:841d:2bce:26c3:59c6]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by che.mayfirst.org (Postfix) with ESMTPSA id 27083F9A6; Thu, 25 Mar 2021 15:27:17 -0400 (EDT)
Received: by fifthhorseman.net (Postfix, from userid 1000) id 826BB20387; Thu, 25 Mar 2021 08:38:12 -0400 (EDT)
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
To: =?utf-8?Q?=C3=81ngel?= <angel@16bits.net>, openpgp@ietf.org
In-Reply-To: <26945b02701cdbcf7af0ebd3adaa325b91021be7.camel@16bits.net>
References: <87wnu86mep.fsf@fifthhorseman.net> <20210324021213.333485-1-dkg@fifthhorseman.net> <87pmzp2taf.fsf@fifthhorseman.net> <26945b02701cdbcf7af0ebd3adaa325b91021be7.camel@16bits.net>
Autocrypt: addr=dkg@fifthhorseman.net; prefer-encrypt=mutual; keydata= mDMEX+i03xYJKwYBBAHaRw8BAQdACA4xvL/xI5dHedcnkfViyq84doe8zFRid9jW7CC9XBiI0QQf FgoAgwWCX+i03wWJBZ+mAAMLCQcJEOCS6zpcoQ26RxQAAAAAAB4AIHNhbHRAbm90YXRpb25zLnNl cXVvaWEtcGdwLm9yZ/tr8E9NA10HvcAVlSxnox6z62KXCInWjZaiBIlgX6O5AxUKCAKbAQIeARYh BMKfigwB81402BaqXOCS6zpcoQ26AADZHQD/Zx9nc3N2kj13AUsKMr/7zekBtgfSIGB3hRCU74Su G44A/34Yp6IAkndewLxb1WdRSokycnaCVyrk0nb4imeAYyoPtBc8ZGtnQGZpZnRoaG9yc2VtYW4u bmV0PojRBBMWCgCDBYJf6LTfBYkFn6YAAwsJBwkQ4JLrOlyhDbpHFAAAAAAAHgAgc2FsdEBub3Rh dGlvbnMuc2VxdW9pYS1wZ3Aub3JnL0Gwxvypz2tu1IPG+yu1zPjkiZwpscsitwrVvzN3bbADFQoI ApsBAh4BFiEEwp+KDAHzXjTYFqpc4JLrOlyhDboAAPkXAP0Z29z7jW+YzLzPTQML4EQLMbkHOfU4 +s+ki81Czt0WqgD/SJ8RyrqDCtEP8+E4ZSR01ysKqh+MUAsTaJlzZjehiQ24MwRf6LTfFgkrBgEE AdpHDwEBB0DkKHOW2kmqfAK461+acQ49gc2Z6VoXMChRqobGP0ubb4kBiAQYFgoBOgWCX+i03wWJ BZ+mAAkQ4JLrOlyhDbpHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3Jnfvo+ nHoxDwaLaJD8XZuXiaqBNZtIGXIypF1udBBRoc0CmwICHgG+oAQZFgoAbwWCX+i03wkQPp1xc3He VlxHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3JnaheiqE7Pfi3Atb3GGTw+ jFcBGOaobgzEJrhEuFpXREEWIQQttUkcnfDcj0MoY88+nXFzcd5WXAAAvrsBAIJ5sBg8Udocv25N stN/zWOiYpnjjvOjVMLH4fV3pWE1AP9T6hzHz7hRnAA8d01vqoxOlQ3O6cb/kFYAjqx3oMXSBhYh BMKfigwB81402BaqXOCS6zpcoQ26AADX7gD/b83VObe14xrNP8xcltRrBZF5OE1rQSPkMNy+eWpk eCwA/1hxiS8ZxL5/elNjXiWuHXEvUGnRoVj745Vl48sZPVYMuDgEX+i03xIKKwYBBAGXVQEFAQEH QIGex1WZbH6xhUBve5mblScGYU+Y8QJOomXH+rr5tMsMAwEICYjJBBgWCgB7BYJf6LTfBYkFn6YA CRDgkus6XKENukcUAAAAAAAeACBzYWx0QG5vdGF0aW9ucy5zZXF1b2lhLXBncC5vcmcEAx9vTD3b J0SXkhvcRcCr6uIDJwic3KFKxkH1m4QW0QKbDAIeARYhBMKfigwB81402BaqXOCS6zpcoQ26AAAX mwD8CWmukxwskU82RZLMk5fm1wCgMB5z8dA50KLw3rgsCykBAKg1w/Y7XpBS3SlXEegIg1K1e6dR fRxL7Z37WZXoH8AH
Date: Thu, 25 Mar 2021 08:38:11 -0400
Message-ID: <87blb72yto.fsf@fifthhorseman.net>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="==-=-="; micalg=pgp-sha256; protocol="application/pgp-signature"
Archived-At: <https://mailarchive.ietf.org/arch/msg/openpgp/8C8nIeBYtbQsPAVjo9F5wulx2Eo>
Subject: Re: [openpgp] [RFC4880bis PATCH] Drop "Compatibility Profiles" section.
X-BeenThere: openpgp@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Ongoing discussion of OpenPGP issues." <openpgp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/openpgp>, <mailto:openpgp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/openpgp/>
List-Post: <mailto:openpgp@ietf.org>
List-Help: <mailto:openpgp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/openpgp>, <mailto:openpgp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 25 Mar 2021 19:27:28 -0000

On Thu 2021-03-25 02:20:16 +0100, Ángel wrote:
> This issue also affected the security considerations section. I made a
> follow-up at https://gitlab.com/dkg/rfc4880bis/-/merge_requests/1

Looks like you've done a merge request against my personal repo, rather
than putting it in the openpgp-wg repo where everyone else will be able
to see it -- i recommend making this MR against
https://gitlab.com/openpgp-wg/rfc4880bis instead so that it gets public
visibility, and the merge requests aren't scattered.  I'm attaching the
proposed patch below so that people following the list can see it.

> I tried to keep what was salvable but ended up leaving just three lines
> from rfc6637.

I'm not convinced that these specific security considerations are
invalid given that the compatibility profiles section is gone.  For
example, do we believe it to be untrue that:

    Compliant applications SHOULD implement, advertise through key
    preferences, and use the strongest algorithms specified in this
    document.

I think that looks correct, and I see no reason to cut it just because
we've dropped the Compatibility Profiles section.

So, (with no hats on) i'm not personally convinced of this change.  What
do other folks in the WG think?

If there are specific points in the Security Considerations section that
you (or anyone else) think should be dropped, or if anyone wants to
propose clarifications or improvements to these sections, I'd be happy
to reconsider a narrower edit too.

              --dkg