Re: [openpgp] First remarks on the last I-D (Was: I-D Action: draft-ietf-openpgp-crypto-refresh-06.txt)

[Stephen Farrell <[e-mail]>]

Hi Werner,

(Aside: I'll be sending out a mail starting a working group
last call for this draft in a second - we had meant to do
that before today but it was a holiday here yesterday and my
co-chair is in travel mode. Meanwhile this thread is a fine
example of that kind of discussion...)

On 07/06/2022 08:32, Werner Koch wrote:
> Hi!
> 
> I have a few brief remarks on the new I-D and the crypto-refresh series
> at all by the design team (DT).

Thanks!

> 
> I am listed as Editor, a role which I did not not want to take up again
> when we had the first talks about relaunching the WG and starting a DT
> in January 2021.  However, Stephen and Paul said that they want to have
> me in even if Paul agreed to do the actual work.

And that's still the case - I think it's generally good
to maintain recognition for people who've done substantial
work even if that wasn't the most recent bunch of work.

> 
> I have not been involved in the design team since last October due to my
> time constraints.  Back then it seemed that all contentious parts had
> been solved and only a few editorial changes, the introduction of X448,
> and updated IANA considerations were missing.  Later it turned out that
> we also need to fix the private key protection scheme.  However, the DT
> added a lot of more things in the meantime which was pretty surprising
> to me.
> 
> The parts of the new I-D which I strongly disagree with are:
> 
> 1. The new AEAD scheme.
> 
>     It seems that this new scheme was introduced for the benefit of
>     allowing GCM as yet another encryption mode.  GCM is a counter mode
>     and as can be seen by the large changes required, hard to get right.
>     We do have GCM now in CMS now because Microsoft decided to go this
>     way.  However, OpenPGP has taken its own decisions based on technical
>     soundness and not based on larger vendor, government or committee
>     decision.
> 
>     The WG once decided to go with EAX and OCB.  EAX was only added to
>     avoid possible patent problems.  However, in the 4.5 years since the
>     introduction of EAX the patent things has expired was invalidated and
>     before the new mode will will be a MUST algorithm in a future OpenPGP
>     RFC (not in 4880bis), there will definitely be no more problem at all
>     with OCB.  I bet that by then an updated FIPS-140 will even allow
>     OCB.
> 
>     Thus my suggestion: Drop all that new AEAD ideas and use what has
>     been deployed and agreed upon in this very WG a long time ago.
>     Further, turn OCB into MUST and EAX into MAY (for backward
>     compatibility to deployed implementations).

That's a good discussion to have, so I'd hope others will
chime in (the more input the easier it can be to establish
if there's rough consensus).

> 
> 2. The removal of the Brainpool curved, as already explicitly listed in
>     early RFC-4880bis drafts, is not acceptable.  It may even raise
>     suspicions that a TLA was somehow involved to keep NIST curves but
>     not Brainpool.  Note I won't share such an opinion, but with crypto
>     algos we also need to look at such political things.
> 
>     Thus please immediately issue -07 with Brainpool re-added.

As above.

> 
> There are probably other things I will eventually comment.  That will
> take more time due to the hard to handle merge request style development
> by the DT in contrast to the former step by step draft release and
> discuss process.

Yeah, there's a bunch of DT changes but I hope you and others
do provide the input we need from the broader WG.

> Salam-Shalom,
> 
>     Werner
> 
> 
> 
> ps.
> I am not sure whether having one of the chairs being the main
> contributor to the crypto-refresh draft was actuallyu helpful.  Even if
> a large amount of his commits are due to his re-formatting of the source
> code.

As the other co-chair (in my case the one with way less
background in PGP:-), I guess I'd disagree, in this case.
ISTM my co-chair (dkg) was very energetic in the DT work
but wasn't pushing his own agenda that I noticed. I do
agree in general though it can be better to have less
involved chairs, but reality means that's not always either
possible, or the best plan. IMO, in this case, I think
it's been fine.

Cheers,
S.