[secdir] [new-work] WG Review: Open Specification for Pretty Good Privacy (openpgp)

The IESG <iesg@ietf.org> Mon, 15 June 2015 14:38 UTC

Return-Path: <new-work-bounces@ietf.org>
X-Original-To: secdir@ietf.org
Delivered-To: secdir@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 524F51ACE36; Mon, 15 Jun 2015 07:38:11 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1434379091; bh=bSQW8p15Mh6e+y2Nfp6Yo1eXSX8Os5Atjl7089g3OMU=; h=MIME-Version:From:To:Message-ID:Date:Subject:Reply-To:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: Content-Type:Content-Transfer-Encoding:Sender; b=V/+yXgIFQUEycf5Vy5+YiF3Jrj29nqyzkAcnj4JNFXbaeogTmD2VMROEKKcGGfJH0 0y8E9zTo+5h0o3vwysvKBKQeMowdqq78THXyKXRaiffwCrZ2XypIFWl5+IqOJyMwFz +Uro1UhjvrRAhI+c3dorJZDszdBqzHLGLfo4EHYk=
X-Original-To: new-work@ietfa.amsl.com
Delivered-To: new-work@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com []) by ietfa.amsl.com (Postfix) with ESMTP id C906F1ACE36; Mon, 15 Jun 2015 07:38:09 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id Z-9Kg5dC9ymK; Mon, 15 Jun 2015 07:38:05 -0700 (PDT)
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 1BE101A86F5; Mon, 15 Jun 2015 07:38:05 -0700 (PDT)
MIME-Version: 1.0
From: The IESG <iesg@ietf.org>
To: <new-work@ietf.org>
X-Test-IDTracker: no
X-IETF-IDTracker: 6.0.3.p3
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <20150615143805.17937.95388.idtracker@ietfa.amsl.com>
Date: Mon, 15 Jun 2015 07:38:05 -0700
Archived-At: <http://mailarchive.ietf.org/arch/msg/new-work/FfHxBv4dWOn2EPIOx2oRhuSDvrM>
X-BeenThere: new-work@ietf.org
X-Mailman-Version: 2.1.15
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: new-work-bounces@ietf.org
Sender: "new-work" <new-work-bounces@ietf.org>
Archived-At: <http://mailarchive.ietf.org/arch/msg/secdir/aCnoTPTzZC6rrWoJrwAKIqR04Rs>
X-Mailman-Approved-At: Tue, 16 Jun 2015 09:02:07 -0700
Subject: [secdir] [new-work] WG Review: Open Specification for Pretty Good Privacy (openpgp)
X-BeenThere: secdir@ietf.org
Reply-To: iesg@ietf.org
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 15 Jun 2015 14:38:11 -0000

A new IETF working group has been proposed in the Security Area. The IESG
has not made any determination yet. The following draft charter was
submitted, and is provided for informational purposes only. Please send
your comments to the IESG mailing list (iesg at ietf.org) by 2015-06-25.

Open Specification for Pretty Good Privacy (openpgp)
Current Status: Proposed WG

  Daniel Gillmor <dkg@fifthhorseman.net>
  Christopher Liljenstolpe <ietf@cdl.asgaard.org>

Assigned Area Director:
  Stephen Farrell <stephen.farrell@cs.tcd.ie>

Mailing list
  Address: openpgp@ietf.org
  To Subscribe: https://www.ietf.org/mailman/listinfo/openpgp


OpenPGP is an Internet standard that covers object encryption, object
signing, and identity certification. These were defined by the first
incarnation of the OpenPGP working group.

The following is an excerpt from the charter of the original incarnation
of the openpgp working group

> The goal of the OpenPGP working group is to provide IETF standards for
> the algorithms and formats of PGP processed objects as well as providing the MIME
> framework for exchanging them via e-mail or other transport protocols.

The working group concluded this work and was closed in March of 2008. In
the intervening period, there has been a rough consensus reached that the
RFC that defined the IETF openpgp standard, RFC4880, is in need of

This incarnation of the working group is chartered to primarily produce a
revision of RFC4880 to address issues that have been identified by the
community since the working group was originally closed.

These revisions will include, but are not limited to:

- Potential inclusion of elliptic curves recommended by the CFRG (see
note below)

- A symmetric encryption mechanism that offers modern message integrity
protection (e.g. AEAD)

- Revision of mandatory-to-implement algorithm selection and deprecation
of weak algorithms

- An updated public-key fingerprint mechanism

The Working Group will perform the following work:

- Revise RFC4880

- Other work related to OpenPGP may be entertained by the working group
as long as it does not interfere with the completion of the RFC4880
revision. As the revision of RFC4880 is the primary goal of the working
group, other work may be undertaken, so long as:

1. The work will not unduly delay the closure of the working group after
the revision is finished (unless the working group is rechartered).

2. The work has widespread support in the working group.

These additional work items may only be added with approval from the
responsible Area Director or by re-chartering.

Inclusion of CFRG Curves

The Working Group will consider CFRG curves as possible Mandatory to
Implement (MTI) based on the output of the CFRG and/or Working Group
consensus in the matter.

Working Group Process

The working group will endeavor to complete most if not all of its work
online on the working group's mailing list. We expect that the
requirement for face-to-face sessions at IETF meetings to be minimal.

Furthermore, the working group will accept no ID's as working group items
unless there is a review by at least two un-interested parties of the ID
as part of the acceptance process.

  Sep 2015 - Working Group (rough) consensus on the necessary updates to
  Feb 2016 - First wg-id for RFC4880bis
  Jul 2016 - RFC4880bis wg-id final call

new-work mailing list