Re: [openpgp] Remarks on Brainpool missing in -06

Hi,

I'll give a "grumbling non-objection", if you will. The MR text is
correct and matches implementations. I personally still think that it's
unclear whether the charter calls for this, though. Having more public-
key algorithms or curves also increases binary size, implementation
effort, attack surface, etc (since one can't really choose not to
implement them, once public keys are out there, since there's no
negotiation mechanism). But, since the implementations are already
there (including the ones I now maintain :')), I guess it's better to
document it than not.

Finally, the state of cryptographic library support for Brainpool is not
great, imo. In OpenPGP.js, we use an implementation from "elliptic.js",
but it's slow and not constant-time [1]. I've looked for other JS
implementations or non-JS implementations that we could compile to
WebAssembly, but didn't find any. In my opinion, it would be great if
the BSI could contribute or invest in some open source, high-quality
implementation(s) of Brainpool, to improve the situation here.

Best,
Daniel

[1]: https://github.com/openpgpjs/openpgpjs/issues/720

------- Original Message -------
On Friday, July 15th, 2022 at 12:33, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:

> Hiya,
>
> On 08/07/2022 13:51, Stephen Farrell wrote:
>
> > Hi all,
> >
> > We seem to perhaps be nearing rough consensus
> > here, so to check that...:
> >
> > Would anyone object if the chairs asked the
> > editors to merge [1]? (And for the editors to
> > come back to the list if there are issues in
> > doing that merge.)
> >
> > If so, please say so and why before July 15th.
>
>
> It's now then, so unless someone yells we'll plan
> to ask the editors to merge [1] or report back if
> trickiness is found in attempting that.
>
> Cheers,
> S.
>
> > Thanks,
> > S.
> >
> > [1] https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/202
> >
> > _______________________________________________
> > openpgp mailing list
> > openpgp@ietf.org
> > https://www.ietf.org/mailman/listinfo/openpgp
>
> _______________________________________________
> openpgp mailing list
> openpgp@ietf.org
> https://www.ietf.org/mailman/listinfo/openpgp