[openpgp] First remarks on the last I-D (Was: I-D Action: draft-ietf-openpgp-crypto-refresh-06.txt)

[Werner Koch <[e-mail]>]

Hi!

I have a few brief remarks on the new I-D and the crypto-refresh series
at all by the design team (DT).

I am listed as Editor, a role which I did not not want to take up again
when we had the first talks about relaunching the WG and starting a DT
in January 2021.  However, Stephen and Paul said that they want to have
me in even if Paul agreed to do the actual work.

I have not been involved in the design team since last October due to my
time constraints.  Back then it seemed that all contentious parts had
been solved and only a few editorial changes, the introduction of X448,
and updated IANA considerations were missing.  Later it turned out that
we also need to fix the private key protection scheme.  However, the DT
added a lot of more things in the meantime which was pretty surprising
to me.

The parts of the new I-D which I strongly disagree with are:

1. The new AEAD scheme.

   It seems that this new scheme was introduced for the benefit of
   allowing GCM as yet another encryption mode.  GCM is a counter mode
   and as can be seen by the large changes required, hard to get right.
   We do have GCM now in CMS now because Microsoft decided to go this
   way.  However, OpenPGP has taken its own decisions based on technical
   soundness and not based on larger vendor, government or committee
   decision.

   The WG once decided to go with EAX and OCB.  EAX was only added to
   avoid possible patent problems.  However, in the 4.5 years since the
   introduction of EAX the patent things has expired was invalidated and
   before the new mode will will be a MUST algorithm in a future OpenPGP
   RFC (not in 4880bis), there will definitely be no more problem at all
   with OCB.  I bet that by then an updated FIPS-140 will even allow
   OCB.

   Thus my suggestion: Drop all that new AEAD ideas and use what has
   been deployed and agreed upon in this very WG a long time ago.
   Further, turn OCB into MUST and EAX into MAY (for backward
   compatibility to deployed implementations).

2. The removal of the Brainpool curved, as already explicitly listed in
   early RFC-4880bis drafts, is not acceptable.  It may even raise
   suspicions that a TLA was somehow involved to keep NIST curves but
   not Brainpool.  Note I won't share such an opinion, but with crypto
   algos we also need to look at such political things.

   Thus please immediately issue -07 with Brainpool re-added.


There are probably other things I will eventually comment.  That will
take more time due to the hard to handle merge request style development
by the DT in contrast to the former step by step draft release and
discuss process.




Salam-Shalom,

   Werner



ps.
I am not sure whether having one of the chairs being the main
contributor to the crypto-refresh draft was actuallyu helpful.  Even if
a large amount of his commits are due to his re-formatting of the source
code.

$ git shortlog -sn      # That's for crypto-refresh-06.tx
   190  Daniel Kahn Gillmor
   104  Werner Koch
     5  Heiko Stamer
     4  brian m. carlson
     3  Paul Wouters
     3  Ronald Tse
     2  Derek Atkins
     2  Vincent Breitmoser
     1  Clint Adams
     1  Guillem Jover
     1  NIIBE Yutaka
     1  Paul Wouters ☕️

$ git shortlog -sn 5db9fe2  # That's for rfc4880bis-10
   101  Werner Koch
    24  Daniel Kahn Gillmor
     5  Heiko Stamer
     4  brian m. carlson
     3  Ronald Tse
     2  Derek Atkins
     1  Clint Adams
     1  Guillem Jover
     1  NIIBE Yutaka
     1  Vincent Breitmoser


--
The pioneers of a warless world are the youth that
refuse military service.             - A. Einstein