IETF Logo Mail Archive

Re: [openpgp] I-D Action: draft-ietf-openpgp-crypto-refresh-02.txt (fwd)

Daniel Kahn Gillmor <dkg@fifthhorseman.net> Sat, 27 February 2021 02:44 UTC

Return-Path: <dkg@fifthhorseman.net>
X-Original-To: openpgp@ietfa.amsl.com
Delivered-To: openpgp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 12FD23A00E4 for <openpgp@ietfa.amsl.com>; Fri, 26 Feb 2021 18:44:19 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=fifthhorseman.net header.b=+Nh9AUFG; dkim=pass (2048-bit key) header.d=fifthhorseman.net header.b=J6acQyO3
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dLL9pU_gCNLF for <openpgp@ietfa.amsl.com>; Fri, 26 Feb 2021 18:44:17 -0800 (PST)
Received: from che.mayfirst.org (che.mayfirst.org [IPv6:2001:470:1:116::7]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 186E93A0121 for <openpgp@ietf.org>; Fri, 26 Feb 2021 18:44:16 -0800 (PST)
DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/simple; d=fifthhorseman.net; i=@fifthhorseman.net; q=dns/txt; s=2019; t=1614393855; h=from : to : cc : subject : in-reply-to : references : date : message-id : mime-version : content-type : from; bh=N6OksRaidhPNqT5alOxVOWXMEYIjGCFoAVTZViJ678c=; b=+Nh9AUFGg7DvOl5cbeJGamXS30Dt0KvSj9OxQf1YShFVfVUYo+OXVC4sWhACm/DrSuO84 0EpeX27BRiffiHwCw==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=fifthhorseman.net; i=@fifthhorseman.net; q=dns/txt; s=2019rsa; t=1614393854; h=from : to : cc : subject : in-reply-to : references : date : message-id : mime-version : content-type : from; bh=N6OksRaidhPNqT5alOxVOWXMEYIjGCFoAVTZViJ678c=; b=J6acQyO32za5ptzltb/fE2PQN+J9KLHydaa87bjz0xhxmvCbwnJSajSBc8Ea/1DOx24zi uoi2ryQrfew7nsma/If6iio2z4sXAmqm8W2Hku4xzUxhBYSeH6DwRs8Z/qG9i24w7v4V2GD O/vUOrlt8eKXOWiSehCxNj1QHEBqe3LkIIZW1sxQRf7rnHCI16CLC7QvUqmvOsqNk3Qrqnj oDbDNvq6upGdDpoBwpptTJo8bCjyHTPfvxRThFR8HHWuv9w/ragDeFUIYqfY63nnPIpIXGn VaMj54Cp41aBmbBukQIHn4TxpXoPqSixIWrSeh7PSiJK8moAjFG2BjlxPb4A==
Received: from fifthhorseman.net (lair.fifthhorseman.net [108.58.6.98]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by che.mayfirst.org (Postfix) with ESMTPSA id 70637F9A6; Fri, 26 Feb 2021 21:44:13 -0500 (EST)
Received: by fifthhorseman.net (Postfix, from userid 1000) id 590D920458; Fri, 26 Feb 2021 20:42:28 -0500 (EST)
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
To: Derek Atkins <derek@ihtfp.com>, Paul Wouters <paul@nohats.ca>
Cc: openpgp@ietf.org
In-Reply-To: <4f3d66b74b46b5b8bf27b5e1589bf80e.squirrel@mail2.ihtfp.org>
References: <7d8bdda1-4e5c-6c10-f3cd-1d191fad595c@nohats.ca> <4f3d66b74b46b5b8bf27b5e1589bf80e.squirrel@mail2.ihtfp.org>
Autocrypt: addr=dkg@fifthhorseman.net; prefer-encrypt=mutual; keydata= mDMEX+i03xYJKwYBBAHaRw8BAQdACA4xvL/xI5dHedcnkfViyq84doe8zFRid9jW7CC9XBiI0QQf FgoAgwWCX+i03wWJBZ+mAAMLCQcJEOCS6zpcoQ26RxQAAAAAAB4AIHNhbHRAbm90YXRpb25zLnNl cXVvaWEtcGdwLm9yZ/tr8E9NA10HvcAVlSxnox6z62KXCInWjZaiBIlgX6O5AxUKCAKbAQIeARYh BMKfigwB81402BaqXOCS6zpcoQ26AADZHQD/Zx9nc3N2kj13AUsKMr/7zekBtgfSIGB3hRCU74Su G44A/34Yp6IAkndewLxb1WdRSokycnaCVyrk0nb4imeAYyoPtBc8ZGtnQGZpZnRoaG9yc2VtYW4u bmV0PojRBBMWCgCDBYJf6LTfBYkFn6YAAwsJBwkQ4JLrOlyhDbpHFAAAAAAAHgAgc2FsdEBub3Rh dGlvbnMuc2VxdW9pYS1wZ3Aub3JnL0Gwxvypz2tu1IPG+yu1zPjkiZwpscsitwrVvzN3bbADFQoI ApsBAh4BFiEEwp+KDAHzXjTYFqpc4JLrOlyhDboAAPkXAP0Z29z7jW+YzLzPTQML4EQLMbkHOfU4 +s+ki81Czt0WqgD/SJ8RyrqDCtEP8+E4ZSR01ysKqh+MUAsTaJlzZjehiQ24MwRf6LTfFgkrBgEE AdpHDwEBB0DkKHOW2kmqfAK461+acQ49gc2Z6VoXMChRqobGP0ubb4kBiAQYFgoBOgWCX+i03wWJ BZ+mAAkQ4JLrOlyhDbpHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3Jnfvo+ nHoxDwaLaJD8XZuXiaqBNZtIGXIypF1udBBRoc0CmwICHgG+oAQZFgoAbwWCX+i03wkQPp1xc3He VlxHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3JnaheiqE7Pfi3Atb3GGTw+ jFcBGOaobgzEJrhEuFpXREEWIQQttUkcnfDcj0MoY88+nXFzcd5WXAAAvrsBAIJ5sBg8Udocv25N stN/zWOiYpnjjvOjVMLH4fV3pWE1AP9T6hzHz7hRnAA8d01vqoxOlQ3O6cb/kFYAjqx3oMXSBhYh BMKfigwB81402BaqXOCS6zpcoQ26AADX7gD/b83VObe14xrNP8xcltRrBZF5OE1rQSPkMNy+eWpk eCwA/1hxiS8ZxL5/elNjXiWuHXEvUGnRoVj745Vl48sZPVYMuDgEX+i03xIKKwYBBAGXVQEFAQEH QIGex1WZbH6xhUBve5mblScGYU+Y8QJOomXH+rr5tMsMAwEICYjJBBgWCgB7BYJf6LTfBYkFn6YA CRDgkus6XKENukcUAAAAAAAeACBzYWx0QG5vdGF0aW9ucy5zZXF1b2lhLXBncC5vcmcEAx9vTD3b J0SXkhvcRcCr6uIDJwic3KFKxkH1m4QW0QKbDAIeARYhBMKfigwB81402BaqXOCS6zpcoQ26AAAX mwD8CWmukxwskU82RZLMk5fm1wCgMB5z8dA50KLw3rgsCykBAKg1w/Y7XpBS3SlXEegIg1K1e6dR fRxL7Z37WZXoH8AH
Date: Fri, 26 Feb 2021 20:42:27 -0500
Message-ID: <871rd2e16k.fsf@fifthhorseman.net>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha256"; protocol="application/pgp-signature"
Archived-At: <https://mailarchive.ietf.org/arch/msg/openpgp/iHkJtKtC18DishzKfL6P11cDWaw>
Subject: Re: [openpgp] I-D Action: draft-ietf-openpgp-crypto-refresh-02.txt (fwd)
X-BeenThere: openpgp@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Ongoing discussion of OpenPGP issues." <openpgp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/openpgp>, <mailto:openpgp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/openpgp/>
List-Post: <mailto:openpgp@ietf.org>
List-Help: <mailto:openpgp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/openpgp>, <mailto:openpgp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 27 Feb 2021 02:44:19 -0000

On Tue 2021-02-23 08:15:06 -0500, Derek Atkins wrote:
>    Implementations SHOULD generate V4 signatures.  Implementations MUST
>    NOT create version 3 signatures; they MAY accept version 3
>    signatures.

As Paul and Werner both noted, this is a hiccup in the transitional
nature of the document.

I've flagged it as https://gitlab.com/openpgp-wg/rfc4880bis/-/issues/15
so that we don't lose track of it.

> There is no MUST create version.  Is this intended to change?

fwiw, (no hats on) i'm not sure that "MUST create" is the right wording
ultimately.  We want "MUST be able to create" or "MUST create [in some
specific context]" but i can't see requiring creation of a signature
type without one of those caveats.

> Later (5.8):
>
>    This packet is obsolete.  An implementation MUST NOT create this
>    packet.  An implementation MAY process such a packet but it MUST
>    return a clear diagnostic that a non-integrity protected packet has
>    been processed.  The implementation SHOULD also return an error in
>    this case and stop processing.
>
> I'm confused by this text.  If an implementation chooses to process this
> packet type (e.g. I have 20-year-old PGP-encrypted messages that I'd still
> like to be able to read without re-encrypting them), why are you saying
> that it should return an error and stop processing?  So it MAY process but
> SHOULD stop processing?  I'm confused.

I've recorded this as
https://gitlab.com/openpgp-wg/rfc4880bis/-/issues/16 and mentioned
Robert's suggestion of how it could be re-phrased.

         --dkg

v2.23.0 | Report a Bug | By Email