IETF Logo Mail Archive

Re: [openpgp] Fingerprints

Phillip Hallam-Baker <phill@hallambaker.com> Thu, 07 May 2015 13:21 UTC

Return-Path: <hallam@gmail.com>
X-Original-To: openpgp@ietfa.amsl.com
Delivered-To: openpgp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 64E751A9081 for <openpgp@ietfa.amsl.com>; Thu, 7 May 2015 06:21:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.278
X-Spam-Level:
X-Spam-Status: No, score=-1.278 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FM_FORGED_GMAIL=0.622, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K06lum3HDE7t for <openpgp@ietfa.amsl.com>; Thu, 7 May 2015 06:21:41 -0700 (PDT)
Received: from mail-la0-x229.google.com (mail-la0-x229.google.com [IPv6:2a00:1450:4010:c03::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC4F41A9080 for <openpgp@ietf.org>; Thu, 7 May 2015 06:21:40 -0700 (PDT)
Received: by lagv1 with SMTP id v1so30408062lag.3 for <openpgp@ietf.org>; Thu, 07 May 2015 06:21:39 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type; bh=rvVS2I01fTFz5pYS4BRsLH70rU3lOKaczC0jxzJpmvw=; b=JZOKBhjMGjcjYmhZVLu6Lr9o6E+vD9o+rPjEzXpswFdF35MpayBwSiYj/yrqZfRM2Q 4+JJm/+68U6rfdu3hzYADx7wlQi6oVuqWjL+Xwvah0tyS3Lw4xQwsN4ltSrAqhA62drb DWseYHcIHSfeJ7XyBWO4tLFqNGK+rrE+IBISghhOeGKOKYMp6QGdp3GQigLir98VglhE sozCYb/YdDkSvDz2cgXrq6qhqQLeZ+nu6VnfhJ+tFjieKplemPU2gwmd+frvNJ3dHP8u xj7jfIfrOwU3QzwNSmhq51uuKtLkMoe6YYGqO8ntCst5xarT0ZMNCnWm//EszgFZzmG5 So1Q==
MIME-Version: 1.0
X-Received: by 10.112.16.42 with SMTP id c10mr3052275lbd.103.1431004899418; Thu, 07 May 2015 06:21:39 -0700 (PDT)
Sender: hallam@gmail.com
Received: by 10.112.203.163 with HTTP; Thu, 7 May 2015 06:21:39 -0700 (PDT)
In-Reply-To: <554B573C.4060607@iang.org>
References: <CAMm+LwhbB+-MnGRBCvprgAGOuu+5CJ2rgod7EBGOQR5UNVrspQ@mail.gmail.com> <87d232lkb6.fsf@alice.fifthhorseman.net> <sjmlhhmakxp.fsf@securerf.ihtfp.org> <871tiupupe.fsf@littlepip.fritz.box> <1430869683.28399.109.camel@scientia.net> <CAMm+LwgE0eOD1JgLYUwA_4Gh+pm-vGGd9hPX9KoUqQ9=RHBygg@mail.gmail.com> <1430937492.28399.127.camel@scientia.net> <CAMm+Lwh2J6mMuDouc1PtBpfTU5Pcwj=+KNDehi6nwRabivoOrg@mail.gmail.com> <1430947872.28399.206.camel@scientia.net> <CAMm+LwjdY2bQ5c_Jiss_JO2xdXxmXtAdytriC7c_=GdB-Vv-bg@mail.gmail.com> <554B573C.4060607@iang.org>
Date: Thu, 07 May 2015 09:21:39 -0400
X-Google-Sender-Auth: wZ35bj17x2u2jKkYwMhqQHiZHv0
Message-ID: <CAMm+Lwj9nCH-jzZ1MwTok6EU4_0mJOvk-PmAzRjVdc5zZjOe3g@mail.gmail.com>
From: Phillip Hallam-Baker <phill@hallambaker.com>
To: ianG <iang@iang.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <http://mailarchive.ietf.org/arch/msg/openpgp/TWRrqNvf9lWMVq_TB_0WmmpwyaA>
Cc: IETF OpenPGP <openpgp@ietf.org>
Subject: Re: [openpgp] Fingerprints
X-BeenThere: openpgp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "Ongoing discussion of OpenPGP issues." <openpgp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/openpgp>, <mailto:openpgp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/openpgp/>
List-Post: <mailto:openpgp@ietf.org>
List-Help: <mailto:openpgp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/openpgp>, <mailto:openpgp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 07 May 2015 13:21:45 -0000

On Thu, May 7, 2015 at 8:14 AM, ianG <iang@iang.org> wrote:
> On 6/05/2015 23:14 pm, Phillip Hallam-Baker wrote:
>>
>> On Wed, May 6, 2015 at 5:31 PM, Christoph Anton Mitterer
>> <calestyo@scientia.net> wrote:
>
>
>>> Is there any broad consensus already about SHA2 vs. SHA3 (except the
>>> traditionalist argument)?
>>
>>
>> The folk I have spoken to were of the opinion that the SHA3 contest
>> actually confirmed people's confidence in SHA2. So I don't see a need
>> to jump to the next bright shiny object.
>>
>> SHA3 is supported in pretty much every stack now, SHA3 is still a bit
>> of a work in progress.
>>
>> So I would suggest that SHA-2-512 be REQUIRED and SHA-3-512 be
>> RECOMMENDED.
>
>
>
>
> All the above is reasonable.  However there is one further argument in
> favour of SHA-3 which is that it is going to come in the form of a much
> larger / more powerful toolkit.  It's no longer "just a hash."
>
> It has specific modes attached to it that can do, for example, AE, and that
> AE mode has (I gather) been used for the CAESAR competition.
>
> Point being, there is a chance that we can do the whole symmetric part with
> only one algorithm... :-o
>
> Now I know this will give people the heebie jeebies, so what I'd say now is
> that we delay a firm decision until NIST have published their spec on SHA-3
> and then review it to get the true story.  My information is based on a
> presentation I saw by the Keccak team, so possibly I'm way off base.  NIST
> will clarify this all.

On the platforms I use, I can expect SHA-3 to arrive in due course but
it isn't going to expose that functionality without a completely new
API.

>From a design point of view it is clear that SHA-2 and SHA-3 are the
choices and one will be REQUIRED and the other RECOMMENDED. Which is
which has no immediate implications and does not even become an issue
until last call.

I have text and I have code for the SHA-2 version. I can get a
standalone draft done next week and then we don't need to keep
circling on this.

v2.23.0 | Report a Bug | By Email