[openpgp] AEAD and Rome (was: First remarks on the last I-D)

[Werner Koch <[e-mail]>]

On Mon, 13 Jun 2022 10:41, Daniel Huigens said:

> the way it is. So I think that while it's not ideal, having GCM
> (in addition to OCB) in the standard is better than not having it.

Fast wind back to the second AES conference in Rome in 2000.  PRZ and
Jon asked me to attend to talk about OpenPGP.  Aside of the MDC thing,
Phil's main fear was that we would add more and more algorithms to
OpenPGP.  We should limit that to help with maintenance in the years to
come.  Thus we agreed to add only new algorithms if they are technically
required but don't give more options than absolutely required.

Right, later we added Camellia and (NIST or Brainpool) for political
reasons.  But we also refused to accept all the new ideas about cool new
algorithms.  Even the Chinese and Russians didn't yet insist on having
their home ciphers added.

Aside of deprecating SHA-1 use, a modern and faster AD algorithm was the
main goal for RFC-4880bis.  The need to also add EAX was due to
uncertainty about the patent status in all application areas.  We
discussed this here and unfortunately had to do that.  However, it was
also clear that EAX won't be used in reality and added only to satisfy
the patent concerns which had bugged PGP over all the 30 years.

But: Adding GCM and having to drop a widely deployed and tested AEAD
cipher is just the opposite of the Rome agreement.


Salam-Shalom,

   Werner


-- 
The pioneers of a warless world are the youth that
refuse military service.             - A. Einstein