Re: [openpgp] Summary v5 fingerprint proposal

[Werner Koch <[e-mail]>]

On Thu, 23 Mar 2017 19:55, [e-mail] said:

> I don't have any objection to truncating the fingerprint to get the
> KeyID. The KeyID is merely a database key (as in key-value, not
> crypto) and has no security value. Implementations already need to
> consider the possibility that there could be a collision in the KeyID.

Okay, let us split the discussion between crypto use and mere database
lookup:

  * Revocation key and Issuer Fingerprint:

    - For a V5 key the 25 leftmost octets are used.

The /Revocation key/ is sensitive in that a preimage attack can be used
to revoke a key.  That is mostly a DOS and thus not really dangerous.
However, I am fine with using the full hash here.

The /Issuer Fingerprint/ is a key to a database to retrieve the key for
verification of signatures.  Thus it does not even need 200 bits but we
could also simply keep it at 160 without problems.  We could also allow
to let the sender decide how long the /Issuer Fingerprint/ shall be.
But a fixed length makes the implementation easier.  I decided for 200
bits to match the probably used human readable format of the
fingerprint.

> You don't need a new format, you'd just specify the new
> fingerprint. You can consider SHA512/t to be a family of hashes of
> output 't'.

I was under the impression that we already agreed that there shall be
only one fingerprint scheme per key.

> Do we have a meta-strategy for an upgrade? For example, if we know
> that you'd pick whatever hash at that time the cool kids recommend,
> change a couple of parameters (like simply bump the key version to v6
> and go), that could be a recommendation in the RFC.

I think this is a good suggestion.


Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.