IETF Logo Mail Archive

Re: including the entire fingerprint of the issuer in an OpenPGP certification

David Shaw <dshaw@jabberwocky.com> Tue, 18 January 2011 21:45 UTC

Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id p0ILjRiP060842 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 18 Jan 2011 14:45:27 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org)
Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id p0ILjRQ2060841; Tue, 18 Jan 2011 14:45:27 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org)
X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f
Received: from walrus.jabberwocky.com (walrus.jabberwocky.com [173.9.29.57]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id p0ILjPWH060836 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for <ietf-openpgp@imc.org>; Tue, 18 Jan 2011 14:45:26 -0700 (MST) (envelope-from dshaw@jabberwocky.com)
Received: from dshaw.nasuni.net (gw-comcast1.nasuni.com [173.166.63.186]) (authenticated bits=0) by walrus.jabberwocky.com (8.14.4/8.14.4) with ESMTP id p0ILjEJF018984 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Tue, 18 Jan 2011 16:45:15 -0500
Subject: Re: including the entire fingerprint of the issuer in an OpenPGP certification
Mime-Version: 1.0 (Apple Message framework v1081)
Content-Type: text/plain; charset="us-ascii"
From: David Shaw <dshaw@jabberwocky.com>
In-Reply-To: <58216C60-3DFD-4312-B514-19243ED4220A@callas.org>
Date: Tue, 18 Jan 2011 16:45:14 -0500
Cc: Werner Koch <wk@gnupg.org>, OpenPGP Working Group <ietf-openpgp@imc.org>
Message-Id: <6C85BB3E-90BC-4FDC-967C-0867F5B1F57F@jabberwocky.com>
References: <E1Pf1WI-0007aL-EN@login01.fos.auckland.ac.nz> <CFCF61BD-9281-4F09-AD31-C5AAC38315FE@callas.org> <4D354A08.1010206@iang.org> <87lj2isgm8.fsf@vigenere.g10code.de> <58216C60-3DFD-4312-B514-19243ED4220A@callas.org>
To: Jon Callas <jon@callas.org>
X-Mailer: Apple Mail (2.1081)
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by hoffman.proper.com id p0ILjQWG060837
Sender: owner-ietf-openpgp@mail.imc.org
Precedence: bulk
List-Archive: <http://www.imc.org/ietf-openpgp/mail-archive/>
List-Unsubscribe: <mailto:ietf-openpgp-request@imc.org?body=unsubscribe>
List-ID: <ietf-openpgp.imc.org>

On Jan 18, 2011, at 12:48 PM, Jon Callas wrote:

> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
>> I agree.  Further I am not sure whether we should do this full
>> fingerprint proposal right now or better wait for SHA-3.  If we would
>> settle now for a new fingerprint signature subpacket we will for sure
>> need to revise that for SHA-3.  We would need to maintain code for the
>> current fingerprint as well as for a SHA-3 for a little eternity.
> 
> If we combine it with a hash-independent fingerprint -- e.g., first byte is an algorithm ID, others are the actual hash -- then we can put it in now and then run with it.

Rather than first byte being an algorithm ID, how about first byte being the version of the fingerprint?  So, it would be "4" for the current fingerprint, "5" for whatever we come up with later, etc.  If it is an algorithm ID, then we could end up with two different people encoding their fingerprints in two different ways, and have to support reading that in the clients.

David

v2.23.0 | Report a Bug | By Email