Re: [openpgp] Stop dragging around old material, please!

Aron: I think Rick is talking about the packet headers [1], not packet
versions.

Rick: GnuPG still generates legacy packet headers for packet types < 16,
AFAIU, so there are quite a lot of artefacts out there in that format.
Some of the changes in the crypto refresh were aimed at discouraging
that. But unfortunately I think we can't get rid of it yet, either.

Best,
Daniel

https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh#section-4.2

------- Original Message -------
On Monday, November 14th, 2022 at 13:02, Aron Wussler <aron@wussler.it> wrote:

> Hi Rick,
> 

> Unfortunately I think that we'll have to support v4 packets for a long while, and having a single reference RFC is a good way forward.
> Creating a compliant implementation will be much harder having 2 specs to follow, with one partly overriding the previous. I personally support this RFC to fully obsolete RFC4880 and RFC6637, and at the same time properly define Curve25519.
> 

> > Is there any use of old packet formats that uses crypto that we would still consider healthy today?
> 

> Probably we'll have to accept v4 packets (PKESK, keys, sigs, ...) for years, not mentioning them is like hiding the complexity under the rug. Also re-specifying v4 gives the chance to change some inner mechanisms (e.g. "An implementation MUST NOT sign or verify using DSA keys" or similarly SHA-1 signatures).
> V3 packets were dropped, because it was an option. V4, not so much.
> 

> 

> Cheers,
> Aron
> 

> --
> Aron Wussler
> Sent with ProtonMail, OpenPGP key 0x7E6761563EFE3930
> 

> 

> 

> ------- Original Message -------
> On Monday, November 14th, 2022 at 12:42, Rick van Rein rick@openfortress.nl wrote:
> 

> 

> 

> > Hello,
> 

> > At IETF 115 I offered to proof-read the draft for this WG.
> > Back then, I thought the old formats were finally being
> > ditched, something I already fought for during RFC 4880.
> 

> > Now I find that it's being renamed to Legacy. I think this
> > is a mistake, but I understand the scare of making choices.
> 

> > Question:
> > Is there any use of old packet formats that uses crypto
> > that we would still consider healthy today? None of the
> > signatures would now be reliable, but the encryption may
> > have protected us during transit back then, but not when
> > our email boxes get broken.
> 

> > Suggestion:
> > There is an option to simply STOP MENTIONING old formats,
> > and relying on registries that continue to allocate their
> > tags. The old format was specified in older RFCs and can
> > still be added to software that wants to be compliant with
> > old forms, even when they are deprecated or obsoleted.
> 

> > Thanks,
> > -Rick
> 

> > _______________________________________________
> > openpgp mailing list
> > openpgp@ietf.org
> > https://www.ietf.org/mailman/listinfo/openpgp_______________________________________________
> 

> openpgp mailing list
> openpgp@ietf.org
> https://www.ietf.org/mailman/listinfo/openpgp

Re: [openpgp] Stop dragging around old material, please!

Attachment: signature.asc