Re: [openpgp] a new draft overlapping the WG draft

[Daniel Kahn Gillmor <[e-mail]>]

On Fri 2022-10-07 19:48:39 +0200, Kai Engert wrote:
> For example, would it make sense to call the previous, commonly accepted 
> RFC 4880 as "OpenPGP-v1"

No one is contesting the contents of RFC 4880.  That document is fixed,
and has been public and static since its publication nearly 15 years
ago.

There are many subtle version numbers tucked in various parts of the
OpenPGP specification that make it difficult to call any one particular
thing as "OpenPGP vX", but probably the closest thing would be to call
RFC 4880 "OpenPGP v4", although the v4 key format was first described in
RFC 2440 (the predecessor to 4880).

> and call an upcoming document, potentially based on crypto-refresh, as
> "OpenPGP-v2"?

The document that this WG is chartered to draft is probably best
approximated as "OpenPGP v5", because of its introduction of v5 keys and
v5 signatures.  The crypto-refresh draft also introduces v2 of the SEIPD
(symmetrically-encrypted, integrity-protected data) packet to support
modern AEAD constructions.

And yes, a future with two competing and incompatible claims to "v5"
(for either keys or signatures) would be a disaster for the OpenPGP
ecosystem.

A future where we have two new formats that are incompatible, but are
explicitly differently-versioned and thus detectable seems like slightly
less of a disaster overall, but it would still result in signficant
additional overhead for implementations that have to support multiple
formats.  In addition to the overhead, having many different formats in
the wild that everyone tries to interoperate with also seems likely to
introduce risks of security problems, for example in "cross-grade"
attacks, or in cases where an attacker may be able to select among
formats to target the most vulnerable wire format.

I do hope the community can come together on a single draft based around
a rough consensus.

    --dkg