Re: [openpgp] First remarks on the last I-D (Was: I-D Action: draft-ietf-openpgp-crypto-refresh-06.txt)

[Justus Winter <[e-mail]>]

Paul Wouters <[e-mail]> writes:

> On Tue, 7 Jun 2022, Werner Koch wrote:
>
>>   The WG once decided to go with EAX and OCB.  EAX was only added to
>>   avoid possible patent problems.  However, in the 4.5 years since the
>>   introduction of EAX the patent things has expired was invalidated and
>>   before the new mode will will be a MUST algorithm in a future OpenPGP
>>   RFC (not in 4880bis), there will definitely be no more problem at all
>>   with OCB.  I bet that by then an updated FIPS-140 will even allow
>>   OCB.
>
> If we have more indication than only your bet, that might be a persuavive
> argument. But right now, GCM is the only FIPS compatible method. So I
> think removing that would be problematic.

We have customers that care about FIPS, and we need a FIPS-compatible
subset of OpenPGP now, rather than wait and hope that some existing
algorithm like OCB will become FIPS-compliant in the future.

>> 2. The removal of the Brainpool curved, as already explicitly listed in
>>   early RFC-4880bis drafts, is not acceptable.  It may even raise
>>   suspicions that a TLA was somehow involved to keep NIST curves but
>>   not Brainpool.  Note I won't share such an opinion, but with crypto
>>   algos we also need to look at such political things.

There are open questions around Brainpool that needs answering.  For
example, why isn't brainpoolP384r1 included?  How do we encode points
and scalars?

Not cherry-picking the commit that partially added Brainpool support to
the bis is the design-team's way of looking for someone to answer these
questions in a constructive fashion.

Justus