Re: [openpgp] SHA3 algorithm ids.

Phillip Hallam-Baker <phill@hallambaker.com> Tue, 11 August 2015 14:06 UTC

Return-Path: <hallam@gmail.com>
X-Original-To: openpgp@ietfa.amsl.com
Delivered-To: openpgp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 41D061A8AB6 for <openpgp@ietfa.amsl.com>; Tue, 11 Aug 2015 07:06:17 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.277
X-Spam-Level:
X-Spam-Status: No, score=-1.277 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FM_FORGED_GMAIL=0.622, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7m35imofRsvU for <openpgp@ietfa.amsl.com>; Tue, 11 Aug 2015 07:06:16 -0700 (PDT)
Received: from mail-lb0-x229.google.com (mail-lb0-x229.google.com [IPv6:2a00:1450:4010:c04::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CE78F1A8AAE for <openpgp@ietf.org>; Tue, 11 Aug 2015 07:06:15 -0700 (PDT)
Received: by lbbtg9 with SMTP id tg9so6933682lbb.1 for <openpgp@ietf.org>; Tue, 11 Aug 2015 07:06:14 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:content-type; bh=BU9wLCMkFtlBRtZMulRXdnz4zb6e/skXQn3ujfoWbGM=; b=nIWFLBZHUoZ6UGYwzR8WePJOoF/zWIQl1uEX1qv24Gyr3KQpukefHxW2oJWAA2jgbU eWEXd4pdO/7eSseyRSMX7HY7E7hQRVOjU2PUdYijg2SzCBs0jCBsTx6eFVCE5TbYIisG Xw79dgIcSHOydZSnnX6vTQe8Wy7yOdPV2YBhJo57EtgI3ENyDezMfUmrIKxvUsCtSGGH 4+wd+1yxYQ0h3iNScgtNx5ua2C0qbGOgS03IBLCZEdYH1ftiqrdVkEpIIxtxJq7YDxMy Sv3yaOrPbhleared5MGbGnSwpBSdu4bLgnnvDs6UVJvMjxxEZ7RMp4/mlQC/6AUzhtdl zRSg==
MIME-Version: 1.0
X-Received: by 10.112.16.225 with SMTP id j1mr26080104lbd.118.1439301974283; Tue, 11 Aug 2015 07:06:14 -0700 (PDT)
Sender: hallam@gmail.com
Received: by 10.112.203.163 with HTTP; Tue, 11 Aug 2015 07:06:14 -0700 (PDT)
In-Reply-To: <87si7qf84a.fsf@vigenere.g10code.de>
References: <87y4hmi19i.fsf@vigenere.g10code.de> <7540C7A9-2830-4A63-8310-B684796DA279@nohats.ca> <55C681FC.9010100@iang.org> <sjma8tztbgo.fsf@securerf.ihtfp.org> <CAMm+Lwj7SxXTn+KD-eQSeZHwJB36tCgD1t0bodVsp3ovOaZ8mw@mail.gmail.com> <87si7qf84a.fsf@vigenere.g10code.de>
Date: Tue, 11 Aug 2015 10:06:14 -0400
X-Google-Sender-Auth: 6bKUXevLkcrHZeUwf5A6QAvUjH0
Message-ID: <CAMm+Lwg=h-mmmrBCciPuEbY2BzDXq58pXU_OPiJna7MOrGe+Ng@mail.gmail.com>
From: Phillip Hallam-Baker <phill@hallambaker.com>
To: Phillip Hallam-Baker <phill@hallambaker.com>, Derek Atkins <derek@ihtfp.com>, IETF OpenPGP <openpgp@ietf.org>, ianG <iang@iang.org>
Content-Type: multipart/alternative; boundary="001a11c3cb62e6db7d051d099a49"
Archived-At: <http://mailarchive.ietf.org/arch/msg/openpgp/CoDKH1B-IN1F6LWxg4oUvz0tEeQ>
Subject: Re: [openpgp] SHA3 algorithm ids.
X-BeenThere: openpgp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "Ongoing discussion of OpenPGP issues." <openpgp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/openpgp>, <mailto:openpgp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/openpgp/>
List-Post: <mailto:openpgp@ietf.org>
List-Help: <mailto:openpgp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/openpgp>, <mailto:openpgp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 11 Aug 2015 14:06:17 -0000

On Tue, Aug 11, 2015 at 6:10 AM, Werner Koch <wk@gnupg.org> wrote:

> On Mon, 10 Aug 2015 22:50, phill@hallambaker.com said:
>
> > Given that email recipients tend to end up having to implement all the
> code
> > points in a cipher suite because they can't really control what is sent,
> I
>
> That is not the case with OpenPGP.  If you encrypt and sign the key
> gives you a list of hash algorithms supported by the recipient.  Only
> those may be used.   In a signature only case there is no point in an using
> extravagant hash algorithm because most recipients won't be able to
> verify such a signature.
>

And what then happens if you use the same key on two different devices
running two different applications?

Advertising crypto capabilities is good. But it isn't a panacea. If people
are going to use end to end encrypted email as default, they have to be
able to read their mail on multiple devices.