Re: [openpgp] First remarks on the last I-D (Was: I-D Action: draft-ietf-openpgp-crypto-refresh-06.txt)

["brian m. carlson" <[e-mail]>]

On 2022-06-07 at 13:24:15, Justus Winter wrote:
> Paul Wouters <[e-mail]> writes:
> 
> > On Tue, 7 Jun 2022, Werner Koch wrote:
> >
> >>   The WG once decided to go with EAX and OCB.  EAX was only added to
> >>   avoid possible patent problems.  However, in the 4.5 years since the
> >>   introduction of EAX the patent things has expired was invalidated and
> >>   before the new mode will will be a MUST algorithm in a future OpenPGP
> >>   RFC (not in 4880bis), there will definitely be no more problem at all
> >>   with OCB.  I bet that by then an updated FIPS-140 will even allow
> >>   OCB.
> >
> > If we have more indication than only your bet, that might be a persuavive
> > argument. But right now, GCM is the only FIPS compatible method. So I
> > think removing that would be problematic.
> 
> We have customers that care about FIPS, and we need a FIPS-compatible
> subset of OpenPGP now, rather than wait and hope that some existing
> algorithm like OCB will become FIPS-compliant in the future.

I agree that OCB is the most desirable option now that the patent has
expired but that we should have FIPS-compatible options as well.  My
position is that FIPS-compatible crypto is usually a mistake, since it
prevents using fast, secure cryptography, but I also know that if we
don't have something FIPS compatible, then we'll end up with government
agencies and contractors using the older non-AEAD schemes, which is
substantially worse from a security perspective.  GCM can be optional
and nobody has to implement it.

I also think binding to the scheme is good and we should keep that.
-- 
brian m. carlson (he/him or they/them)
Toronto, Ontario, CA