Re: [openpgp] a new draft overlapping the WG draft

[Andrew Gallagher <[e-mail]>]

On 27 Sep 2022, at 06:39, Peter Gutmann <[e-mail]> wrote:
> 
> Stephen Farrell <[e-mail]> writes:
> 
>> It's come to our attention that a new draft [1] has been published that
>> basically aims to be an alternative to the WG draft. [2]
> 
> Is anyone involved in the drafts able to do a tl;dr of the significant
> differences?  Looking through the diffs there's an awful lot of small
> editorial changes that don't seem to make much difference, one has Argon, one
> has a bunch of stuff for notations with no obvious purpose (inventory control
> springs immediately to mind, but why put that in the PGP spec?) and removes
> some PGP 2.x-era bits, and then around about page 70 I hit the ;dr part of
> tl;dr.

Notation Data is in both drafts, and has been in the spec since RFC2440. The alternative drafts just define it in different sections.

I see that none of the clarifications I submitted to crypto-refresh have been ported across to -bis00, and neither have many of the corrections and clarifications submitted by others (I can’t keep track of them all). IMO bringing -bis00 up to a similar state of readiness to that of crypto-refresh will require the WG going back over and re-agreeing to significant amounts of uncontroversial changes, never mind the initial work involved in refactoring the source text.

There are significant sections that differ so greatly that the IETF diff tool has essentially given up, marking both versions as changed (everything between "11.3 OpenPGP Messages” and “12.4/13.4 Key Derivation Function”, anything to do with the elliptic curve formats, and everything from “Jallad, Katz and Schneier” onwards). I haven’t had time to go through them, but even keeping the common denominator (as suggested by Kai) would itself require a significant amount of work disentangling the substantial changes from the presentational.

So I vote for keeping the current crypto-refresh draft, but stay open to porting across substantial changes from -bis00. (I would urge that one such port should be attestation signatures, since they are already implemented in some clients and are not to my knowledge controversial, but that decision can be made later). Starting again from scratch or merging the documents equally would be a huge task.

A