Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7VBsPCD052792 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 31 Aug 2010 04:54:25 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7VBsPCF052791; Tue, 31 Aug 2010 04:54:25 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from zucker.schokokeks.org (zucker.schokokeks.org [78.46.69.5]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7VBsNff052786 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO) for ; Tue, 31 Aug 2010 04:54:24 -0700 (MST) (envelope-from hanno@hboeck.de) Received: from laverne.localnet (brln-4d0c0c0f.pool.mediaWays.net [::ffff:77.12.12.15]) (AUTH: PLAIN hanno-default@schokokeks.org, TLS: TLSv1/SSLv3,256bits,AES256-SHA) by zucker.schokokeks.org with esmtp; Tue, 31 Aug 2010 13:54:21 +0200 id 000000000001800D.000000004C7CED6D.00007F2F From: Hanno =?utf-8?q?B=C3=B6ck?= To: ietf-openpgp@imc.org Subject: Support RSA-PSS? Date: Tue, 31 Aug 2010 13:54:20 +0200 User-Agent: KMail/1.13.5 (Linux/2.6.35.4; KDE/4.4.5; x86_64; ; ) MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart1606913.trZo8Espqm"; protocol="application/pgp-signature"; micalg=pgp-sha1 Content-Transfer-Encoding: 7bit Message-Id: <201008311354.20954.hanno@hboeck.de> Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: --nextPart1606913.trZo8Espqm Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi, Hi, I'm currently writing my diploma thesis about RSA-PSS, an improved signatur= e=20 scheme for RSA. It is specified in PKCS #1 2.1. Part of my thesis is=20 researching the status of implementations and standards. Are there any plans to support RSA-PSS in openpgp? RFC 4880 only supports t= he=20 old padding scheme from pkcs #1 1.5. cu, =2D-=20 Hanno B=C3=B6ck Blog: http://www.hboeck.de/ GPG: 3DBD3B20 Jabber/Mail: hanno@hboeck.de http://schokokeks.org - professional webhosting --nextPart1606913.trZo8Espqm Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) iEYEABECAAYFAkx87WwACgkQr2QksT29OyDzTwCfeg5+Ivw+w8ppKetccz25HrZ9 fNUAniq7toDBI5FPjT1vVS1vavTJCEqJ =8Wfx -----END PGP SIGNATURE----- --nextPart1606913.trZo8Espqm-- Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7V7u1ut038391 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 31 Aug 2010 00:56:01 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7V7u14f038390; Tue, 31 Aug 2010 00:56:01 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from mail.h2np.net (sea.h2np.net [220.110.1.194]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7V7txRd038385 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NO) for ; Tue, 31 Aug 2010 00:56:00 -0700 (MST) (envelope-from hironobu@mail.h2np.net) Received: from lax.h2np.net ([220.110.1.195] helo=mail.h2np.net) by mail.h2np.net with esmtp (Exim 4.69) (envelope-from ) id 1OqLhG-0003ZY-3z; Tue, 31 Aug 2010 16:55:58 +0900 From: Hironobu SUZUKI To: Peter Gutmann cc: ietf-openpgp@imc.org Subject: Re: ECC in OpenPGP In-reply-to: References: Comments: In-reply-to Peter Gutmann message dated "Tue, 31 Aug 2010 18:33:38 +1200." X-Mailer: MH-E 8.0.3; nmh 1.3; GNU Emacs 22.2.1 Date: Tue, 31 Aug 2010 16:55:58 +0900 Message-ID: <26713.1283241358@mail.h2np.net> Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: Peter Gutmann wrote: > > Hironobu SUZUKI writes: > > >I wrote some program for Ruby OpenSSL Sample. > > Thanks for posting that. Would it be possible to break them down a bit > further to show sign and verify times separately? A big downside of DLP-based > PKCs is that verification is quite slow, which really bites you in a > sign-once, verify-many situation. > You can run test your own computer. This program for ECC/160, RSA/DSA1024. h2np.net is my site. $ wget -O i.taz 'http://h2np.net/tips/wiki/index.php?plugin=attach&pcmd=open&file=sign_test.tar.gz&refer=RubyOpenSSLDigitalSignatureSample' $ tar zxvf i.taz $ cd sign_test $ for i in *.rb; do ruby $i speed ; done DSA signature test ...OK Speed test start...Done Signing 0.297371 msec Verify 0.293092 msec S+V 0.590463 msec EC signature test ...OK Speed test start...Done Signing 0.401606 msec Verify 0.427266 msec S+V 0.828873 msec RSA signature test ...OK Speed test start...Done Signing 0.501700 msec Verify 0.028194 msec S+V 0.529893 msec Speed depends on openssl library of your system. For example, RSA under opensolaris + openssl-0.9.8h is slow because configuration of openssl-0.9.8h can't handle sungcc well. I don't know about last openssl. I agree about sign-once, verify-many situation. It's nice for Software distrubution. But if user want to sign on their e-mail with RSA/4K, it is too slow and users must be patient. I think RSA/3K is acceptable for Desktop computer. Please see 'PI Calculation Time Ranking' on my site. http://h2np.net/pi/pi_record_e.html Desktop CPU has been faster and faster, implementation technique become more sophisticate. I think RSA/3K is not faster but acceptable. I'm wondering RSA/4K is 'practically' required within next ten years. Regards, --- Hironobu SUZUKI Tokyo, Japan. http://h2np.net Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7V6Xiqa034209 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 30 Aug 2010 23:33:44 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7V6Xi1L034208; Mon, 30 Aug 2010 23:33:44 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from mx2-int.auckland.ac.nz (mx2-int.auckland.ac.nz [130.216.12.41]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7V6XdDh034203 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=FAIL) for ; Mon, 30 Aug 2010 23:33:43 -0700 (MST) (envelope-from pgut001@cs.auckland.ac.nz) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=pgut001@cs.auckland.ac.nz; q=dns/txt; s=uoa; t=1283236423; x=1314772423; h=from:to:subject:cc:in-reply-to:message-id:date; z=From:=20Peter=20Gutmann=20 |To:=20hironobu@h2np.net,=20jon@callas.org|Subject:=20Re: =20ECC=20in=20OpenPGP|Cc:=20ietf-openpgp@imc.org |In-Reply-To:=20<17360.1283222623@mail.h2np.net> |Message-Id:=20|Date:=20Tue,=2031=20Aug=202010=2018:33:38=20+120 0; bh=KA2cCA22PAvINRrkA7GFvA0YZP1g4qvNPeUNDEz/zic=; b=AQ4K4e2rwgpKT9NB69RVxNFd9h4GJogCt9Woc7PZo4KF6vvL4WK29Cwf P6qJJsHgmqGc7YjlP6EjCEaOoivSsIf2z/fpwHFpHobxVicPYbLoADFOU 1xdEgKvdSyMfz8NNF2hVA5dLim2J9EsZtt+H7J8UdwVFAJgwlkb0ogevz 4=; X-IronPort-AV: E=Sophos;i="4.56,297,1280664000"; d="scan'208";a="23602209" X-Ironport-HAT: UNIVERSITY - $RELAY-THROTTLE X-Ironport-Source: 130.216.207.92 - Outgoing - Outgoing Received: from wintermute02.cs.auckland.ac.nz ([130.216.207.92]) by mx2-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 31 Aug 2010 18:33:39 +1200 Received: from pgut001 by wintermute02.cs.auckland.ac.nz with local (Exim 4.69) (envelope-from ) id 1OqKPa-0001Pn-MP; Tue, 31 Aug 2010 18:33:38 +1200 From: Peter Gutmann To: hironobu@h2np.net, jon@callas.org Subject: Re: ECC in OpenPGP Cc: ietf-openpgp@imc.org In-Reply-To: <17360.1283222623@mail.h2np.net> Message-Id: Date: Tue, 31 Aug 2010 18:33:38 +1200 Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: Hironobu SUZUKI writes: >I wrote some program for Ruby OpenSSL Sample. Thanks for posting that. Would it be possible to break them down a bit further to show sign and verify times separately? A big downside of DLP-based PKCs is that verification is quite slow, which really bites you in a sign-once, verify-many situation. Peter. Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7V2hlrq023235 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 30 Aug 2010 19:43:48 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7V2hlq2023234; Mon, 30 Aug 2010 19:43:47 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from mail.h2np.net (sea.h2np.net [220.110.1.194]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7V2hjND023229 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NO) for ; Mon, 30 Aug 2010 19:43:47 -0700 (MST) (envelope-from hironobu@mail.h2np.net) Received: from lax.h2np.net ([220.110.1.195] helo=mail.h2np.net) by mail.h2np.net with esmtp (Exim 4.69) (envelope-from ) id 1OqGp5-0007ts-OC; Tue, 31 Aug 2010 11:43:43 +0900 From: Hironobu SUZUKI To: Jon Callas cc: OpenPGP Working Group Subject: Re: ECC in OpenPGP In-reply-to: References: <1282856536.11340.29.camel@fermat.scientia.net> <87pqx4mm0b.fsf@vigenere.g10code.de> <04ac7894a29b891da7cbde98adb287e5@imap.dd24.net> <83BF96BC-A771-4511-B431-9B9B1545E351@callas.org> <49ee22eb2e5747f077b3bc885f197083@imap.dd24.net> <87y6boj5e0.fsf@vigenere.g10code.de> <4C7C4939.8050009@iang.org> Comments: In-reply-to Jon Callas message dated "Mon, 30 Aug 2010 17:44:53 -0700." X-Mailer: MH-E 8.0.3; nmh 1.3; GNU Emacs 22.2.1 Date: Tue, 31 Aug 2010 11:43:43 +0900 Message-ID: <17360.1283222623@mail.h2np.net> Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: Jon Callas wrote: > > If you're happy with 128-bit security, then you don't need ECC. RSA is > just fine. If you want 256-bit security, then you have a quandary. You > either need to go beyond 4096-bit RSA keys, or go to ECC. It's that > simple. I agree. I wrote some program for Ruby OpenSSL Sample. openssl-0.9.8h + ruby-1.9.0-4 http://h2np.net/tips/wiki/index.php?RubyOpenSSLDigitalSignatureSample Symmetric ECC RSA/DSA 1 80 160 1024 2 112 224 2048 3 128 256 3072 4 192 384 8192 5 256 521 15360 Sign+Verify time (sec) ECDSA DSA RSA-SIGN 1 2.555977 0.929024 1.076000 2 2.926534 2.645445 5.111679 3 3.592816 5.505652 14.402504 4 7.161274 30.169381 191.516328 5 9.017966 - - (sec) RSA/2K-key isn't so slow, it's OK. RSA/3K-key is slow but acceptable. Regards, --- Hironobu SUZUKI FSIJ / WCLSCAN / OpenPKSD Tokyo, Japan. Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7V0j20x017773 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 30 Aug 2010 17:45:02 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7V0j2NM017772; Mon, 30 Aug 2010 17:45:02 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from merrymeet.com (merrymeet.com [66.93.68.160]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7V0j1XM017767 for ; Mon, 30 Aug 2010 17:45:01 -0700 (MST) (envelope-from jon@callas.org) Received: from localhost (localhost [127.0.0.1]) by merrymeet.com (Postfix) with ESMTP id 9BF812E074 for ; Mon, 30 Aug 2010 17:45:17 -0700 (PDT) Received: from merrymeet.com ([127.0.0.1]) by localhost (host.domain.tld [127.0.0.1]) (amavisd-maia, port 10024) with ESMTP id 89076-05 for ; Mon, 30 Aug 2010 17:45:11 -0700 (PDT) Received: from keys.merrymeet.com (keys.merrymeet.com [66.93.68.161]) (Authenticated sender: jon) by merrymeet.com (Postfix) with ESMTPA id D7A9A2E05D for ; Mon, 30 Aug 2010 17:45:11 -0700 (PDT) Received: from il0102a-dhcp109.apple.com ([17.201.27.237]) by keys.merrymeet.com (PGP Universal service); Mon, 30 Aug 2010 17:38:39 -0700 X-PGP-Universal: processed; by keys.merrymeet.com on Mon, 30 Aug 2010 17:38:39 -0700 Mime-Version: 1.0 (Apple Message framework v1081) Subject: Re: ECC in OpenPGP From: Jon Callas In-Reply-To: <4C7C4939.8050009@iang.org> Date: Mon, 30 Aug 2010 17:44:53 -0700 Message-Id: References: <1282856536.11340.29.camel@fermat.scientia.net> <87pqx4mm0b.fsf@vigenere.g10code.de> <04ac7894a29b891da7cbde98adb287e5@imap.dd24.net> <83BF96BC-A771-4511-B431-9B9B1545E351@callas.org> <49ee22eb2e5747f077b3bc885f197083@imap.dd24.net> <87y6boj5e0.fsf@vigenere.g10code.de> <4C7C4939.8050009@iang.org> To: OpenPGP Working Group X-Mailer: Apple Mail (2.1081) X-PGP-Encoding-Format: Partitioned X-PGP-Encoding-Version: 2.0.2 X-Content-PGP-Universal-Saved-Content-Transfer-Encoding: quoted-printable X-Content-PGP-Universal-Saved-Content-Type: text/plain; charset=us-ascii Content-Type: text/plain; charset="us-ascii" X-Virus-Scanned: Maia Mailguard Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from QUOTED-PRINTABLE to 8bit by hoffman.proper.com id o7V0j2XM017768 Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > > Is it really worth switching horses across to ECC from RSA? The NSA seems to think so... > > Let me put it this way, as a hypothetical: if OpenPGP next-gen had to choose between RSA and ECC, only implement one of them, which would we choose? That's the wrong question, really. There's one and only one reason to seriously consider ECC, and that is that you want public keys with security greater than 128 bits, and you don't want unwieldy key sizes. NIST says that a 3Kbit integer public key has the same security as 128-bit symmetric keys, and that to get to 256 bits, you need a 15Kbit integer key. Argue with NIST's assessment this if you like -- heck, I *like* the argument, myself -- but the point is that if you want crypto-balance with AES-256, then RSA is unwieldy. No argument there. If you're happy with 128-bit security, then you don't need ECC. RSA is just fine. If you want 256-bit security, then you have a quandary. You either need to go beyond 4096-bit RSA keys, or go to ECC. It's that simple. One could argue that there is no need to do this before say 2020 or 2025, thus mooting the whole Certicom/RIM patent issue. There is merit to this way of dealing with it. However, if one wants one's protocol to be used with Suite B or things that are effectively Suite B, then one needs ECC before then. Andrey Jivsov has circulated a draft for ECC in OpenPGP that was intentionally built to both satisfy Suite B and to avoid the whole patent thing, only using freely-usable technology. He probably needs to push that along some more. :-) Jon -----BEGIN PGP SIGNATURE----- Version: PGP Universal 2.10.0 (Build 554) Charset: us-ascii wj8DBQFMfE8PsTedWZOD3gYRAgcsAKD+mWuqGtIaClxngXzdgPl8+x4flwCbBZdl pefyVwOE4C49i3Js2a6zJ34= =IZ9M -----END PGP SIGNATURE----- Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7V0Dn0e016096 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 30 Aug 2010 17:13:49 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7V0DnNU016095; Mon, 30 Aug 2010 17:13:49 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from fiddle.it (slice.reviewedpress.com [67.207.137.25] (may be forged)) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7V0DmSE016090 for ; Mon, 30 Aug 2010 17:13:48 -0700 (MST) (envelope-from iang@iang.org) Received: from viento.local (localhost [127.0.0.1]) by fiddle.it (Postfix) with ESMTP id 8EB51406C2; Tue, 31 Aug 2010 00:13:46 +0000 (UTC) Message-ID: <4C7C4939.8050009@iang.org> Date: Tue, 31 Aug 2010 10:13:45 +1000 From: Ian G User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100802 Lightning/1.0b2 Thunderbird/3.1.2 MIME-Version: 1.0 To: ietf-openpgp@imc.org Subject: ECC in OpenPGP References: <1282856536.11340.29.camel@fermat.scientia.net> <87pqx4mm0b.fsf@vigenere.g10code.de> <04ac7894a29b891da7cbde98adb287e5@imap.dd24.net> <83BF96BC-A771-4511-B431-9B9B1545E351@callas.org> <49ee22eb2e5747f077b3bc885f197083@imap.dd24.net> <87y6boj5e0.fsf@vigenere.g10code.de> In-Reply-To: <87y6boj5e0.fsf@vigenere.g10code.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: Open Question! On 31/08/10 4:56 AM, Werner Koch wrote: >> That's also why I'm very pleased about the ID on ECC,... having it sooner >> than later available makes me sleep much better. > > That is something more worth to put your energy it. I'd really like to > see ECC implemented. ECC has been around for a while now, and while we don't have the inside info on what Certicom/NSA really think, I'm curious whether the open crypto community has got an impression as to its relative merits as against RSA. Is it really worth switching horses across to ECC from RSA? The NSA seems to think so... Let me put it this way, as a hypothetical: if OpenPGP next-gen had to choose between RSA and ECC, only implement one of them, which would we choose? iang Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7UNHjYI013701 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 30 Aug 2010 16:17:45 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7UNHjcQ013700; Mon, 30 Aug 2010 16:17:45 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from mailgw01.dd24.net (mailgw01.dd24.net [193.46.215.41]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7UNHhCf013692 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO) for ; Mon, 30 Aug 2010 16:17:45 -0700 (MST) (envelope-from calestyo@scientia.net) Received: from localhost (amavis01.dd24.net [192.168.1.111]) by mailgw01.dd24.net (Postfix) with ESMTP id 9DFBB7CC2BE for ; Mon, 30 Aug 2010 23:17:42 +0000 (GMT) X-Virus-Scanned: domaindiscount24.com mail filter gateway Received: from mailgw01.dd24.net ([192.168.1.191]) by localhost (amavis01.dd24.net [192.168.1.105]) (amavisd-new, port 10191) with ESMTP id yS4h7V6l5lHA for ; Mon, 30 Aug 2010 23:17:38 +0000 (GMT) Received: from [192.168.0.100] (ppp-93-104-55-182.dynamic.mnet-online.de [93.104.55.182]) by mailgw01.dd24.net (Postfix) with ESMTPA id 9E7757CC2BC for ; Mon, 30 Aug 2010 23:17:38 +0000 (GMT) Subject: Re: SERPENT in OpenPGP? From: Christoph Anton Mitterer To: ietf-openpgp@imc.org In-Reply-To: <87y6boj5e0.fsf@vigenere.g10code.de> References: <1282856536.11340.29.camel@fermat.scientia.net> <87pqx4mm0b.fsf@vigenere.g10code.de> <04ac7894a29b891da7cbde98adb287e5@imap.dd24.net> <83BF96BC-A771-4511-B431-9B9B1545E351@callas.org> <49ee22eb2e5747f077b3bc885f197083@imap.dd24.net> <87y6boj5e0.fsf@vigenere.g10code.de> Content-Type: text/plain; charset="UTF-8" Date: Tue, 31 Aug 2010 01:17:37 +0200 Message-ID: <1283210257.3236.34.camel@fermat.scientia.net> Mime-Version: 1.0 X-Mailer: Evolution 2.30.3 Content-Transfer-Encoding: 7bit Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: On Mon, 2010-08-30 at 20:56 +0200, Werner Koch wrote: > Well, it is free software and thus easy to change. In fact, you only > need to convince the maintainer of one of theses Debian based distros > and it will soon be availabale to a lot of users. Would be just a waste of time, nobody would include such code, if upstream already has no intention to merge it... btw: why does libgcrypt support anything else than the mainstreams (AES,3DES,DES,CAMELLIA)? At least it seems from (http://www.gnupg.org/documentation/manuals/gcrypt/Available-ciphers.html#Available-ciphers) that e.g. serpent would be already in? > That is not that I > suggest to do it ;-). Well if the majority obviously wants to have everything restricted to the current majors... then yes =) Guess this is a similar discussion as with Whirlpool... > > That's also why I'm very pleased about the ID on ECC,... having it sooner > > than later available makes me sleep much better. > > That is something more worth to put your energy it. I'd really like to > see ECC implemented. Would also see this to be the most important todo right now,... nevertheless, the other points I've mentioned before (stricter/clearer standard or general revision as Ian + more certifyable attributes) would be close to the priority of ECC (IMHO). But I guess there's also little chances to see any of them ;) Cheers, Chris. Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7UJ0DoI000603 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 30 Aug 2010 12:00:13 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7UJ0DR7000602; Mon, 30 Aug 2010 12:00:13 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from kerckhoffs.g10code.com (kerckhoffs.g10code.com [217.69.77.222]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7UJ0Bc8000592 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NO) for ; Mon, 30 Aug 2010 12:00:12 -0700 (MST) (envelope-from wk@gnupg.org) Received: from uucp by kerckhoffs.g10code.com with local-rmail (Exim 4.69 #1 (Debian)) id 1Oq9aT-0001k1-8O for ; Mon, 30 Aug 2010 21:00:09 +0200 Received: from wk by vigenere.g10code.de with local (Exim 4.69 #1 (Debian)) id 1Oq9XL-00022t-OK; Mon, 30 Aug 2010 20:56:55 +0200 From: Werner Koch To: Christoph Anton Mitterer Cc: Subject: Re: SERPENT in OpenPGP? References: <1282856536.11340.29.camel@fermat.scientia.net> <87pqx4mm0b.fsf@vigenere.g10code.de> <04ac7894a29b891da7cbde98adb287e5@imap.dd24.net> <83BF96BC-A771-4511-B431-9B9B1545E351@callas.org> <49ee22eb2e5747f077b3bc885f197083@imap.dd24.net> Organisation: g10 Code GmbH OpenPGP: id=5B0358A2; url=finger:wk@g10code.com Date: Mon, 30 Aug 2010 20:56:55 +0200 In-Reply-To: <49ee22eb2e5747f077b3bc885f197083@imap.dd24.net> (Christoph Anton Mitterer's message of "Fri, 27 Aug 2010 20:00:15 +0000") Message-ID: <87y6boj5e0.fsf@vigenere.g10code.de> User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: On Fri, 27 Aug 2010 22:00, calestyo@scientia.net said: > Of course,.. and if Werner as lead developer behind one of the tow major > implementations (the major in opensource) says "no",... than things are > pretty clear, that any work towards it would be rather wasted. Well, it is free software and thus easy to change. In fact, you only need to convince the maintainer of one of theses Debian based distros and it will soon be availabale to a lot of users. That is not that I suggest to do it ;-). > That's also why I'm very pleased about the ID on ECC,... having it sooner > than later available makes me sleep much better. That is something more worth to put your energy it. I'd really like to see ECC implemented. Salam-Shalom, Werner -- Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz. Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RK8j9G015429 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 27 Aug 2010 13:08:45 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7RK8jts015428; Fri, 27 Aug 2010 13:08:45 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from merrymeet.com (merrymeet.com [66.93.68.160]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RK8i4t015418 for ; Fri, 27 Aug 2010 13:08:45 -0700 (MST) (envelope-from jon@callas.org) Received: from localhost (localhost [127.0.0.1]) by merrymeet.com (Postfix) with ESMTP id 0C4B42E09F for ; Fri, 27 Aug 2010 13:08:52 -0700 (PDT) Received: from merrymeet.com ([127.0.0.1]) by localhost (host.domain.tld [127.0.0.1]) (amavisd-maia, port 10024) with ESMTP id 44430-08 for ; Fri, 27 Aug 2010 13:08:49 -0700 (PDT) Received: from keys.merrymeet.com (keys.merrymeet.com [66.93.68.161]) (Authenticated sender: jon) by merrymeet.com (Postfix) with ESMTPA id 5454B2E071 for ; Fri, 27 Aug 2010 13:08:41 -0700 (PDT) Received: from il0102a-dhcp109.apple.com ([17.201.27.237]) by keys.merrymeet.com (PGP Universal service); Fri, 27 Aug 2010 13:02:37 -0700 X-PGP-Universal: processed; by keys.merrymeet.com on Fri, 27 Aug 2010 13:02:37 -0700 Subject: Re: SERPENT in OpenPGP? Mime-Version: 1.0 (Apple Message framework v1081) From: Jon Callas In-Reply-To: Date: Fri, 27 Aug 2010 13:08:31 -0700 Cc: Jon Callas , OpenPGP Working Group Message-Id: <14881272-22F4-4232-80C5-D6AA0C9A723C@callas.org> References: <1282856536.11340.29.camel@fermat.scientia.net> <3C0E8216-05E0-4E92-BC30-9B63CAEADF59@callas.org> <1282862498.18783.20.camel@fermat.scientia.net> <4C7761F4.1050507@iang.org> <23AB7412-7309-4C95-B27A-E14119879CB9@callas.org> To: Christoph Anton Mitterer X-Mailer: Apple Mail (2.1081) X-PGP-Encoding-Format: Partitioned X-PGP-Encoding-Version: 2.0.2 X-Content-PGP-Universal-Saved-Content-Transfer-Encoding: quoted-printable X-Content-PGP-Universal-Saved-Content-Type: text/plain; charset=us-ascii Content-Type: text/plain; charset="us-ascii" X-Virus-Scanned: Maia Mailguard Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from QUOTED-PRINTABLE to 8bit by hoffman.proper.com id o7RK8j4t015424 Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > At least to my (limited) understanding,... it seemed logical that it would > be stronger. > Imagine a quick factorising algorithm would be found,... RSA would be > broken, but ElGamal not automatically,... (at least I've never heard about, > that the factorisation problem can be transformed into the discrete > logarithm problem). It can. If there is a fast factoring algorithm, then there is also a fast discrete log algorithm. Jon -----BEGIN PGP SIGNATURE----- Version: PGP Universal 2.10.0 (Build 554) Charset: us-ascii wj8DBQFMeBndsTedWZOD3gYRAsB5AJwLSNja3YsDoTPr8AIOMscXtfSv6QCg3BSO iIP/WjaPp5p0ykXlZZM/BUM= =5lRB -----END PGP SIGNATURE----- Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RK0RF5014976 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 27 Aug 2010 13:00:27 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7RK0RZk014975; Fri, 27 Aug 2010 13:00:27 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from mailgw01.dd24.net (mailgw01.dd24.net [193.46.215.41]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RK0PO1014968 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO) for ; Fri, 27 Aug 2010 13:00:26 -0700 (MST) (envelope-from calestyo@scientia.net) Received: from localhost (amavis01.dd24.net [192.168.1.111]) by mailgw01.dd24.net (Postfix) with ESMTP id 739287CCC02 for ; Fri, 27 Aug 2010 20:00:24 +0000 (GMT) X-Virus-Scanned: domaindiscount24.com mail filter gateway Received: from mailgw01.dd24.net ([192.168.1.191]) by localhost (amavis01.dd24.net [192.168.1.105]) (amavisd-new, port 10191) with ESMTP id 4+tDUJe4IGX8 for ; Fri, 27 Aug 2010 20:00:20 +0000 (GMT) Received: from webmail.dd24.net (webmail01.dd24.net [193.46.215.65]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mailgw01.dd24.net (Postfix) with ESMTPSA id 0588D7CC8A9 for ; Fri, 27 Aug 2010 20:00:20 +0000 (GMT) MIME-Version: 1.0 Date: Fri, 27 Aug 2010 20:00:15 +0000 From: Christoph Anton Mitterer To: Subject: Re: SERPENT in =?UTF-8?Q?OpenPGP=3F?= In-Reply-To: <83BF96BC-A771-4511-B431-9B9B1545E351@callas.org> References: <1282856536.11340.29.camel@fermat.scientia.net> <87pqx4mm0b.fsf@vigenere.g10code.de> <04ac7894a29b891da7cbde98adb287e5@imap.dd24.net> <83BF96BC-A771-4511-B431-9B9B1545E351@callas.org> Message-ID: <49ee22eb2e5747f077b3bc885f197083@imap.dd24.net> X-Sender: calestyo@scientia.net User-Agent: RoundCube Webmail/0.3.1 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: On Fri, 27 Aug 2010 10:51:10 -0700, Jon Callas wrote: > I'll be just a bit softer than Werner. The obstacle to your suggestion is > adoption. Of course,.. and if Werner as lead developer behind one of the tow major implementations (the major in opensource) says "no",... than things are pretty clear, that any work towards it would be rather wasted. > On the other hand, so what? Your name on an RFC is a resume-builder. And > you could code it up yourself. If a real break comes to AES, you could end > up looking prescient. Well it's not my intention to become "famous" or so ;) It's just that I (and I really like OpenPGP in contrast to its "competitors") see three problems (be aware that, while having visited some crypto lectures when I studied,... I'm by far no expert): - IMO the current standard is too lax in many aspects, or not clearly and strictly enough. Of course the major implementations are simply doing the right thing usually... so this is rather a formal problem than a real. Guess there is not much need to elaborate this again,.. I've already discussed some parts of that here before,... - It could easily happen that we sleep to long on our success and at some day we get into real trouble when something (e.g. SHA1) is broken (or at least much closer to be so than now) and we have no alternatives up and working. That's also why I personally think it would be a good idea to have alternatives like Serpent,... Even though unlikely that this happens soon or from one day to the other, just imagine that AES might get broken. The only alternatives now would be Twofish, 3DES and Camellia. And as you said yourself, it can take very long as new things are adopted in the real world. That's also why I'm very pleased about the ID on ECC,... having it sooner than later available makes me sleep much better. If you take for example the suggested keysizes (http://www.keylength.com/) you already see that there are sources suggesting sizes far beyond the 4096 for the long term scale. - As again noted about, OpenPGP could offer much more attributes to be signable. At best using strings for each attribute type, e.g. things like ietf@name.surname or so for "official" ones,... and org.example@someSpecificAttribute for everybody). Looking at mainstream server SSL, OpenPGP already lost against X.509. But there are still many communities where OpenPGP is mainly used. However, just having username/email is often not enough for them. Can tell you from the LHC Grid community,... where we're using X.509 because we need to store additional attributes in the certificates. > OpenPGP is designed to be to be welcoming to new algorithms -- all you > need is a new algorithm number, really. But it's also designed to have easy > rejection of algorithms that individuals or the community don't like. The > algorithm preferences and negotiation ensures that no sender can ram > something down a receiver's throat. Of course,.. but again,... little use when the majors have no intention anyway. > The upshot of this is that if *you* want to use Serpent and some new > compression algorithm and other things, you can. But if you want *us* to do > it too, then you have to convince us. Well,.. guess I've already tried that. May main argument are probably the advantages of diversity. But I can understand Werner's arguments, that one would have to maintain the code (which opens the window for security problems), that e.g. Serpent is less analysed than the mainstream AES, etc. pp. Cheers, Chris. Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RJWxJL013749 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 27 Aug 2010 12:32:59 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7RJWxna013748; Fri, 27 Aug 2010 12:32:59 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from mailgw01.dd24.net (mailgw01.dd24.net [193.46.215.41]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RJWwSa013743 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO) for ; Fri, 27 Aug 2010 12:32:59 -0700 (MST) (envelope-from calestyo@scientia.net) Received: from localhost (amavis01.dd24.net [192.168.1.111]) by mailgw01.dd24.net (Postfix) with ESMTP id 01D367CCD3D for ; Fri, 27 Aug 2010 19:32:57 +0000 (GMT) X-Virus-Scanned: domaindiscount24.com mail filter gateway Received: from mailgw01.dd24.net ([192.168.1.191]) by localhost (amavis01.dd24.net [192.168.1.105]) (amavisd-new, port 10191) with ESMTP id CbdX2gXaZeGK for ; Fri, 27 Aug 2010 19:32:52 +0000 (GMT) Received: from webmail.dd24.net (webmail01.dd24.net [193.46.215.65]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mailgw01.dd24.net (Postfix) with ESMTPSA id 881D47CC2AA for ; Fri, 27 Aug 2010 19:32:52 +0000 (GMT) MIME-Version: 1.0 Date: Fri, 27 Aug 2010 19:32:48 +0000 From: Christoph Anton Mitterer To: OpenPGP Working Group Subject: Re: SERPENT in =?UTF-8?Q?OpenPGP=3F?= In-Reply-To: <23AB7412-7309-4C95-B27A-E14119879CB9@callas.org> References: <1282856536.11340.29.camel@fermat.scientia.net> <3C0E8216-05E0-4E92-BC30-9B63CAEADF59@callas.org> <1282862498.18783.20.camel@fermat.scientia.net> <4C7761F4.1050507@iang.org> <23AB7412-7309-4C95-B27A-E14119879CB9@callas.org> Message-ID: X-Sender: calestyo@scientia.net User-Agent: RoundCube Webmail/0.3.1 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: On Fri, 27 Aug 2010 10:33:13 -0700, Jon Callas wrote: > And you're right that there's no guarantee that it's stronger, which is > probably why no one does it. If someone is worried about RSA-2048 and > AES-128, then the obvious step up is RSA-4096 and AES-256. Or perhaps > Elgamal-4096 and Twofish-256. That's easy and you can *measure* how much > stronger it is. At least to my (limited) understanding,... it seemed logical that it would be stronger. Imagine a quick factorising algorithm would be found,... RSA would be broken, but ElGamal not automatically,... (at least I've never heard about, that the factorisation problem can be transformed into the discrete logarithm problem). Cheers, Chris. Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RHpLZW009350 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 27 Aug 2010 10:51:21 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7RHpL1b009349; Fri, 27 Aug 2010 10:51:21 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from merrymeet.com (merrymeet.com [66.93.68.160]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RHpKxC009344 for ; Fri, 27 Aug 2010 10:51:20 -0700 (MST) (envelope-from jon@callas.org) Received: from localhost (localhost [127.0.0.1]) by merrymeet.com (Postfix) with ESMTP id B3C402E09F for ; Fri, 27 Aug 2010 10:51:27 -0700 (PDT) Received: from merrymeet.com ([127.0.0.1]) by localhost (host.domain.tld [127.0.0.1]) (amavisd-maia, port 10024) with ESMTP id 43207-04 for ; Fri, 27 Aug 2010 10:51:23 -0700 (PDT) Received: from keys.merrymeet.com (keys.merrymeet.com [66.93.68.161]) (Authenticated sender: jon) by merrymeet.com (Postfix) with ESMTPA id 1244A2E076 for ; Fri, 27 Aug 2010 10:51:20 -0700 (PDT) Received: from [10.0.23.9] ([66.93.68.163]) by keys.merrymeet.com (PGP Universal service); Fri, 27 Aug 2010 10:45:17 -0700 X-PGP-Universal: processed; by keys.merrymeet.com on Fri, 27 Aug 2010 10:45:17 -0700 Subject: Re: SERPENT in OpenPGP? Mime-Version: 1.0 (Apple Message framework v1081) From: Jon Callas In-Reply-To: <04ac7894a29b891da7cbde98adb287e5@imap.dd24.net> Date: Fri, 27 Aug 2010 10:51:10 -0700 Cc: Jon Callas , Message-Id: <83BF96BC-A771-4511-B431-9B9B1545E351@callas.org> References: <1282856536.11340.29.camel@fermat.scientia.net> <87pqx4mm0b.fsf@vigenere.g10code.de> <04ac7894a29b891da7cbde98adb287e5@imap.dd24.net> To: Christoph Anton Mitterer X-Mailer: Apple Mail (2.1081) X-PGP-Encoding-Format: Partitioned X-PGP-Encoding-Version: 2.0.2 X-Content-PGP-Universal-Saved-Content-Transfer-Encoding: quoted-printable X-Content-PGP-Universal-Saved-Content-Type: text/plain; charset=us-ascii Content-Type: text/plain; charset="us-ascii" X-Virus-Scanned: Maia Mailguard Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from QUOTED-PRINTABLE to 8bit by hoffman.proper.com id o7RHpLxC009345 Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'll be just a bit softer than Werner. The obstacle to your suggestion is adoption. You can write a document, push it through the IETF, and then you have Serpent in OpenPGP. However, it's unlikely that many implementations would put it in, for all the reasons people have said here. It would be little more than your name on an RFC if no one codes it up. On the other hand, so what? Your name on an RFC is a resume-builder. And you could code it up yourself. If a real break comes to AES, you could end up looking prescient. OpenPGP is designed to be to be welcoming to new algorithms -- all you need is a new algorithm number, really. But it's also designed to have easy rejection of algorithms that individuals or the community don't like. The algorithm preferences and negotiation ensures that no sender can ram something down a receiver's throat. The upshot of this is that if *you* want to use Serpent and some new compression algorithm and other things, you can. But if you want *us* to do it too, then you have to convince us. OpenPGP is both a welcoming community and a balkanized collection of cliques. One of the very clever things we did was to be able to be both at the same time. Jon -----BEGIN PGP SIGNATURE----- Version: PGP Universal 2.10.0 (Build 554) Charset: us-ascii wj8DBQFMd/mtsTedWZOD3gYRAgSAAJ98lpNoTK9ikEZRXmtvQt2Og4gx+gCeKDyx S1MEpI4VrXQwyo9HqZS5Ko4= =IOfu -----END PGP SIGNATURE----- Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RHXSHx008452 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 27 Aug 2010 10:33:28 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7RHXStZ008451; Fri, 27 Aug 2010 10:33:28 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from merrymeet.com (merrymeet.com [66.93.68.160]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RHXQHF008445 for ; Fri, 27 Aug 2010 10:33:27 -0700 (MST) (envelope-from jon@callas.org) Received: from localhost (localhost [127.0.0.1]) by merrymeet.com (Postfix) with ESMTP id 650882E04C for ; Fri, 27 Aug 2010 10:33:33 -0700 (PDT) Received: from merrymeet.com ([127.0.0.1]) by localhost (host.domain.tld [127.0.0.1]) (amavisd-maia, port 10024) with ESMTP id 43010-07 for ; Fri, 27 Aug 2010 10:33:29 -0700 (PDT) Received: from keys.merrymeet.com (keys.merrymeet.com [66.93.68.161]) (Authenticated sender: jon) by merrymeet.com (Postfix) with ESMTPA id 4B8992E089 for ; Fri, 27 Aug 2010 10:33:24 -0700 (PDT) Received: from [10.0.23.9] ([66.93.68.163]) by keys.merrymeet.com (PGP Universal service); Fri, 27 Aug 2010 10:27:21 -0700 X-PGP-Universal: processed; by keys.merrymeet.com on Fri, 27 Aug 2010 10:27:21 -0700 Subject: Re: SERPENT in OpenPGP? Mime-Version: 1.0 (Apple Message framework v1081) From: Jon Callas In-Reply-To: Date: Fri, 27 Aug 2010 10:33:13 -0700 Cc: Jon Callas , Ian G , Christoph Anton Mitterer , OpenPGP Working Group Message-Id: <23AB7412-7309-4C95-B27A-E14119879CB9@callas.org> References: <1282856536.11340.29.camel@fermat.scientia.net> <3C0E8216-05E0-4E92-BC30-9B63CAEADF59@callas.org> <1282862498.18783.20.camel@fermat.scientia.net> <4C7761F4.1050507@iang.org> To: "Robert J. Hansen" X-Mailer: Apple Mail (2.1081) X-PGP-Encoding-Format: Partitioned X-PGP-Encoding-Version: 2.0.2 X-Content-PGP-Universal-Saved-Content-Transfer-Encoding: quoted-printable X-Content-PGP-Universal-Saved-Content-Type: text/plain; charset=us-ascii Content-Type: text/plain; charset="us-ascii" X-Virus-Scanned: Maia Mailguard Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from QUOTED-PRINTABLE to 8bit by hoffman.proper.com id o7RHXRHF008446 Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > > I am surprised no one has observed the combination of ciphers A and B may be no better, or even worse, than either A or B by themselves. As a trivial example, double ROT13 is much worse than single ROT13. As a real-world example, double DES is no better than single DES. > > It appears to me, at my present level of ignorance, that an abundance of caution is appropriate. To be pedantic, the example you're giving is not A+B, but A+A, which is in fact proven to be only as strong as A. That's why it's 3DES, not 2DES. And you're right that there's no guarantee that it's stronger, which is probably why no one does it. If someone is worried about RSA-2048 and AES-128, then the obvious step up is RSA-4096 and AES-256. Or perhaps Elgamal-4096 and Twofish-256. That's easy and you can *measure* how much stronger it is. But a few years ago, there was some new crypto thingie that I can't remember the name of. They specifically double encrypted with different symmetric and asymmetric ciphers. They got some very nice security analysis from Niels Ferguson and Russ Housley as well. It was very nice work. But the counter-argument is precisely that we can't measure how much stronger it is. Jon -----BEGIN PGP SIGNATURE----- Version: PGP Universal 2.10.0 (Build 554) Charset: us-ascii wj8DBQFMd/V5sTedWZOD3gYRAl25AJ9+1y8FQf07NhYVIrslM7yG1dX5ZwCg4A+i H531DZLJXlIqoB7wkHq/JgQ= =6Cz4 -----END PGP SIGNATURE----- Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RBiWlk088999 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 27 Aug 2010 04:44:32 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7RBiWrf088998; Fri, 27 Aug 2010 04:44:32 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from shards.monkeyblade.net (shards.monkeyblade.net [198.137.202.13]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RBiV4p088992 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 27 Aug 2010 04:44:32 -0700 (MST) (envelope-from rjh@sixdemonbag.org) Received: from [10.1.10.100] (c-68-55-125-169.hsd1.md.comcast.net [68.55.125.169]) (authenticated bits=0) by shards.monkeyblade.net (8.14.4/8.14.3) with ESMTP id o7RBiPsL022350 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Fri, 27 Aug 2010 04:44:26 -0700 X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.95.3 at shards.monkeyblade.net Subject: Re: SERPENT in OpenPGP? Mime-Version: 1.0 (Apple Message framework v1081) Content-Type: text/plain; charset=us-ascii From: "Robert J. Hansen" In-Reply-To: <4C7761F4.1050507@iang.org> Date: Fri, 27 Aug 2010 07:44:24 -0400 Cc: Christoph Anton Mitterer , OpenPGP Working Group Message-Id: References: <1282856536.11340.29.camel@fermat.scientia.net> <3C0E8216-05E0-4E92-BC30-9B63CAEADF59@callas.org> <1282862498.18783.20.camel@fermat.scientia.net> <4C7761F4.1050507@iang.org> To: Ian G X-Mailer: Apple Mail (2.1081) X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.3 (shards.monkeyblade.net [198.137.202.13]); Fri, 27 Aug 2010 04:44:26 -0700 (PDT) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by hoffman.proper.com id o7RBiW4o088994 Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: > This is a tricky area. By trying to create a stronger cipher (and that is what you are doing, combining A + B to make cipher C) you are putting yourself above the cryptographers ... who presumably tried to make A and B quite strong already. I am surprised no one has observed the combination of ciphers A and B may be no better, or even worse, than either A or B by themselves. As a trivial example, double ROT13 is much worse than single ROT13. As a real-world example, double DES is no better than single DES. It appears to me, at my present level of ignorance, that an abundance of caution is appropriate. Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RBeBZm088802 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 27 Aug 2010 04:40:11 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7RBeB9T088801; Fri, 27 Aug 2010 04:40:11 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from kerckhoffs.g10code.com (kerckhoffs.g10code.com [217.69.77.222]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RBe9PZ088796 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NO) for ; Fri, 27 Aug 2010 04:40:11 -0700 (MST) (envelope-from wk@gnupg.org) Received: from uucp by kerckhoffs.g10code.com with local-rmail (Exim 4.69 #1 (Debian)) id 1OoxI0-0000pJ-Tx for ; Fri, 27 Aug 2010 13:40:08 +0200 Received: from wk by vigenere.g10code.de with local (Exim 4.69 #1 (Debian)) id 1OoxGl-0002Jh-GZ; Fri, 27 Aug 2010 13:38:51 +0200 From: Werner Koch To: Christoph Anton Mitterer Cc: OpenPGP Working Group Subject: Re: SERPENT in OpenPGP? References: <1282856536.11340.29.camel@fermat.scientia.net> <3C0E8216-05E0-4E92-BC30-9B63CAEADF59@callas.org> <1282862498.18783.20.camel@fermat.scientia.net> <4C7761F4.1050507@iang.org> <67fb91a3317482de5850fca61bf8dac4@imap.dd24.net> Organisation: g10 Code GmbH OpenPGP: id=5B0358A2; url=finger:wk@g10code.com Date: Fri, 27 Aug 2010 13:38:51 +0200 In-Reply-To: <67fb91a3317482de5850fca61bf8dac4@imap.dd24.net> (Christoph Anton Mitterer's message of "Fri, 27 Aug 2010 10:37:30 +0000") Message-ID: <87vd6wl1ys.fsf@vigenere.g10code.de> User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: On Fri, 27 Aug 2010 12:37, calestyo@scientia.net said: > Ok all true,.. but again,.. as far as I understand the system... > preferences and the least required algorithms should solve all this. > Even for those implementations of OpenPGP which don't support the > bleeding-edge. This is true as long as you use the same implementaion. As soon as you switch your computing environment things get complicated. Maybe you decide to continue work on a mainframe and over there you don't have an implementation of Twofish - you would need to re-encrypt all your mails and documents to one of the MUST algorithms. I know folks insisting on IDEA because they don't wont to re-encrypt their PGP 2 created data. > And I don't mean (of course) the semantics behind our PKI (which I > consider far superior to the X509 PKI), but also the technical stuff like Just for the records: OpenPGP does not define or require a PKI - for a good reason. There are mereley features in the protocol which allow to build all kinds of infrastructure on top of it. Salam-Shalom, Werner -- Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz. Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RB8JB2086944 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 27 Aug 2010 04:08:19 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7RB8JNc086943; Fri, 27 Aug 2010 04:08:19 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from mailgw01.dd24.net (mailgw01.dd24.net [193.46.215.41]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RB8HF8086937 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO) for ; Fri, 27 Aug 2010 04:08:18 -0700 (MST) (envelope-from calestyo@scientia.net) Received: from localhost (amavis02.dd24.net [192.168.1.113]) by mailgw01.dd24.net (Postfix) with ESMTP id 2846C7CC301 for ; Fri, 27 Aug 2010 11:08:17 +0000 (GMT) X-Virus-Scanned: domaindiscount24.com mail filter gateway Received: from mailgw01.dd24.net ([192.168.1.191]) by localhost (amavis02.dd24.net [192.168.1.106]) (amavisd-new, port 10191) with ESMTP id JBa3muVW4mtC for ; Fri, 27 Aug 2010 11:08:12 +0000 (GMT) Received: from webmail.dd24.net (webmail01.dd24.net [193.46.215.65]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mailgw01.dd24.net (Postfix) with ESMTPSA id 3698D7CCD00 for ; Fri, 27 Aug 2010 10:40:17 +0000 (GMT) MIME-Version: 1.0 Date: Fri, 27 Aug 2010 10:40:13 +0000 From: Christoph Anton Mitterer To: Subject: Re: SERPENT in =?UTF-8?Q?OpenPGP=3F?= In-Reply-To: <87pqx4mm0b.fsf@vigenere.g10code.de> References: <1282856536.11340.29.camel@fermat.scientia.net> <87pqx4mm0b.fsf@vigenere.g10code.de> Message-ID: <04ac7894a29b891da7cbde98adb287e5@imap.dd24.net> X-Sender: calestyo@scientia.net User-Agent: RoundCube Webmail/0.3.1 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: On Fri, 27 Aug 2010 11:40:36 +0200, Werner Koch wrote: > No. We have strong algorithms and we try to keep the list of algorithms > short for better interoperability. I can see no reason to add Serpent > to OpenPGP; there is no advantage. Well than I guess David, you can save your time and not sending me your xml from the camellia draft. Cheers, Chris. Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RB79EB086890 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 27 Aug 2010 04:07:09 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7RB792d086889; Fri, 27 Aug 2010 04:07:09 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from mailgw01.dd24.net (mailgw01.dd24.net [193.46.215.41]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RB77DW086883 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO) for ; Fri, 27 Aug 2010 04:07:08 -0700 (MST) (envelope-from calestyo@scientia.net) Received: from localhost (amavis02.dd24.net [192.168.1.113]) by mailgw01.dd24.net (Postfix) with ESMTP id F2D777CC16F for ; Fri, 27 Aug 2010 11:07:06 +0000 (GMT) X-Virus-Scanned: domaindiscount24.com mail filter gateway Received: from mailgw01.dd24.net ([192.168.1.191]) by localhost (amavis02.dd24.net [192.168.1.106]) (amavisd-new, port 10191) with ESMTP id dbX2oie9DU83 for ; Fri, 27 Aug 2010 11:07:02 +0000 (GMT) Received: from webmail.dd24.net (webmail01.dd24.net [193.46.215.65]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mailgw01.dd24.net (Postfix) with ESMTPSA id 7D94F7CCF0F for ; Fri, 27 Aug 2010 10:37:34 +0000 (GMT) MIME-Version: 1.0 Date: Fri, 27 Aug 2010 10:37:30 +0000 From: Christoph Anton Mitterer To: OpenPGP Working Group Subject: Re: SERPENT in =?UTF-8?Q?OpenPGP=3F?= In-Reply-To: <4C7761F4.1050507@iang.org> References: <1282856536.11340.29.camel@fermat.scientia.net> <3C0E8216-05E0-4E92-BC30-9B63CAEADF59@callas.org> <1282862498.18783.20.camel@fermat.scientia.net> <4C7761F4.1050507@iang.org> Message-ID: <67fb91a3317482de5850fca61bf8dac4@imap.dd24.net> X-Sender: calestyo@scientia.net User-Agent: RoundCube Webmail/0.3.1 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: On Fri, 27 Aug 2010 16:57:56 +1000, Ian G wrote: > There is a cost to supporting more algorithms - interoperability. In > practice, this cost is greater than any marginal benefit gained by > introducing additional algorithms. (I claim, IMHO) Of course,.. that's why I wrote that this has advantages in my initial post. But we already request conforming implementations to support a least common subset of algorithms, and the preference mechanism should do the rest IMHO. I'd rather suggest on a mid-term-scale to add new ones the required algos, e.g something like: DSA -> RSA (or DSA2) 3DES -> AES > For example, we don't have much experience of algorithms being crunched. > Even the old TDES is pretty strong, and while MD5 is looking shaky, it > hasn't in practice resulted in much more than embarrassment and > arguments. Users have not lost because of these choices. > > In contrast, we have a lot of experience with users not being able to > use additional algorithms, because one user has it but others do not. > Most of this reduces to using the compulsory set, but some of it reduces > to not using crypto at all. Ok all true,.. but again,.. as far as I understand the system... preferences and the least required algorithms should solve all this. Even for those implementations of OpenPGP which don't support the bleeding-edge. > (Also there is the cost of coding it up, and the weakness inherent in > having switches in the code, where without the alternatives there would > be no switching.) Agreed... but IMHO,... using a variety of ciphers (I don't mean at the same time here) could be even an advantage for security. Of course the non-mainstream algos are less analysed like e.g. AES, but this of course also means, that attackers know probably less about them. > This is a tricky area. By trying to create a stronger cipher (and that > is what you are doing, combining A + B to make cipher C) you are putting > yourself above the cryptographers ... who presumably tried to make A and > B quite strong already. That was my idea,... just without the putting myself over the cryptographers ;) > mmmm possibly. I wrote a while ago that (IMHO) we should not try and > fiddle with the current OpenPGP structures, instead we should finish the > RFC ... then start a complete rewrite. Sounds nice to me,... although I wouldn't completely throw away with what we have. And I don't mean (of course) the semantics behind our PKI (which I consider far superior to the X509 PKI), but also the technical stuff like byte format etc. And it would have to be possible to use the new one with the old one. Perhaps even more possible representations (XML in addition to the current ones)... lots of possible ideas (of course not all worth their efforts ;) ) Cheers, Chris. Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RB3K7E086717 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 27 Aug 2010 04:03:20 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7RB3K6v086716; Fri, 27 Aug 2010 04:03:20 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from mailgw01.dd24.net (mailgw01.dd24.net [193.46.215.41]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7RB3I7f086710 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO) for ; Fri, 27 Aug 2010 04:03:19 -0700 (MST) (envelope-from calestyo@scientia.net) Received: from localhost (amavis02.dd24.net [192.168.1.113]) by mailgw01.dd24.net (Postfix) with ESMTP id 4F7D57CCA7B for ; Fri, 27 Aug 2010 11:03:17 +0000 (GMT) X-Virus-Scanned: domaindiscount24.com mail filter gateway Received: from mailgw01.dd24.net ([192.168.1.191]) by localhost (amavis02.dd24.net [192.168.1.106]) (amavisd-new, port 10191) with ESMTP id ZrndX+OZwtww for ; Fri, 27 Aug 2010 11:03:12 +0000 (GMT) Received: from webmail.dd24.net (webmail01.dd24.net [193.46.215.65]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mailgw01.dd24.net (Postfix) with ESMTPSA id 2E88A7CCE30 for ; Fri, 27 Aug 2010 10:24:19 +0000 (GMT) MIME-Version: 1.0 Date: Fri, 27 Aug 2010 10:24:15 +0000 From: Christoph Anton Mitterer To: OpenPGP Working Group Subject: Re: SERPENT in =?UTF-8?Q?OpenPGP=3F?= In-Reply-To: <8FA2B319-DA31-4262-A3AB-98BF4A85C4A2@jabberwocky.com> References: <1282856536.11340.29.camel@fermat.scientia.net> <3C0E8216-05E0-4E92-BC30-9B63CAEADF59@callas.org> <1282862498.18783.20.camel@fermat.scientia.net> <8FA2B319-DA31-4262-A3AB-98BF4A85C4A2@jabberwocky.com> Message-ID: X-Sender: calestyo@scientia.net User-Agent: RoundCube Webmail/0.3.1 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: On Thu, 26 Aug 2010 19:51:20 -0400, David Shaw wrote: > I don't know that you need my permission, but in any event by all means > please do plagiarize it. Frankly, you could make a Serpent draft in short > order by simply replacing the string "Camellia" with "Serpent" and changing > the references. Most of the text there applies just as well to Serpent as > it does to Camellia. Well it's less a legal permission issue, I guess. But one could consider it impolitely ;) > I can send you the XML source to the draft if you like - xml2rfc handles > all the RFC formatting and boilerplate for you. Then please do so,... but the lists should not expect anything yet.... I first have to look whether I find all the needed references, etc. As you probably all know,... Serpent is not that well standardised (e.g. as and RFC). Cheers, Chris. Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7R9jBvO081987 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 27 Aug 2010 02:45:11 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7R9jB3P081986; Fri, 27 Aug 2010 02:45:11 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from kerckhoffs.g10code.com (kerckhoffs.g10code.com [217.69.77.222]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7R9j9qc081979 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NO) for ; Fri, 27 Aug 2010 02:45:10 -0700 (MST) (envelope-from wk@gnupg.org) Received: from uucp by kerckhoffs.g10code.com with local-rmail (Exim 4.69 #1 (Debian)) id 1OovUi-0008U6-NR for ; Fri, 27 Aug 2010 11:45:08 +0200 Received: from wk by vigenere.g10code.de with local (Exim 4.69 #1 (Debian)) id 1OovQK-00025v-Cb; Fri, 27 Aug 2010 11:40:36 +0200 From: Werner Koch To: Christoph Anton Mitterer Cc: ietf-openpgp@imc.org Subject: Re: SERPENT in OpenPGP? References: <1282856536.11340.29.camel@fermat.scientia.net> Organisation: g10 Code GmbH OpenPGP: id=5B0358A2; url=finger:wk@g10code.com Date: Fri, 27 Aug 2010 11:40:36 +0200 In-Reply-To: <1282856536.11340.29.camel@fermat.scientia.net> (Christoph Anton Mitterer's message of "Thu, 26 Aug 2010 23:02:16 +0200") Message-ID: <87pqx4mm0b.fsf@vigenere.g10code.de> User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: On Thu, 26 Aug 2010 23:02, calestyo@scientia.net said: > Have it ever been considered to add SERPENT to OpenPGP? No. We have strong algorithms and we try to keep the list of algorithms short for better interoperability. I can see no reason to add Serpent to OpenPGP; there is no advantage. Nowadays we use AES as the one true standardized algorithms. For backward compatibility we support a few other algorithms as well. Twofish is a special case because back in 1999 we considered it a good idea to add a 128 bit block size cipher to OpenPGP and picked a promising candidate from the AES contest. Twofish didn't win the competition but we kept it for backward compatibility. This backward compatibility is also a reason why we should not add new algorithms just for the fun of it. We will have to support those algorithms for the next decades on all kind of devices and each extra algorithms makes that harder from a maintenance point of view. Camellia has been added because it is a required algorithm in Japan, like AES in the US and elsewhere. Salam-Shalom, Werner -- Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz. Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7R6w0bh074378 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 26 Aug 2010 23:58:00 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7R6w0pc074377; Thu, 26 Aug 2010 23:58:00 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from fiddle.it (slice.reviewedpress.com [67.207.137.25] (may be forged)) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7R6vxaW074372 for ; Thu, 26 Aug 2010 23:58:00 -0700 (MST) (envelope-from iang@iang.org) Received: from viento.local (localhost [127.0.0.1]) by fiddle.it (Postfix) with ESMTP id 50794406C2; Fri, 27 Aug 2010 06:57:57 +0000 (UTC) Message-ID: <4C7761F4.1050507@iang.org> Date: Fri, 27 Aug 2010 16:57:56 +1000 From: Ian G User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100802 Lightning/1.0b2 Thunderbird/3.1.2 MIME-Version: 1.0 To: Christoph Anton Mitterer CC: OpenPGP Working Group Subject: Re: SERPENT in OpenPGP? References: <1282856536.11340.29.camel@fermat.scientia.net> <3C0E8216-05E0-4E92-BC30-9B63CAEADF59@callas.org> <1282862498.18783.20.camel@fermat.scientia.net> In-Reply-To: <1282862498.18783.20.camel@fermat.scientia.net> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: Just all IMHO... On 27/08/10 8:41 AM, Christoph Anton Mitterer wrote: > > On Thu, 2010-08-26 at 15:00 -0700, Jon Callas wrote: >> OpenPGP has Twofish, for which pretty much all the same things can be >> said. If you don't like AES, you should likely be using Twofish or >> Serpent. OpenPGP happens to have Twofish in it. > Yes I know... > Just don't see the reason why OpenPGP is rather conservative with it's > implemented algorithms. > Not only for ciphers, but also e.g. compression algorithms (supporting > XZ would IMHO make sense). There is a cost to supporting more algorithms - interoperability. In practice, this cost is greater than any marginal benefit gained by introducing additional algorithms. (I claim, IMHO) For example, we don't have much experience of algorithms being crunched. Even the old TDES is pretty strong, and while MD5 is looking shaky, it hasn't in practice resulted in much more than embarrassment and arguments. Users have not lost because of these choices. In contrast, we have a lot of experience with users not being able to use additional algorithms, because one user has it but others do not. Most of this reduces to using the compulsory set, but some of it reduces to not using crypto at all. (Also there is the cost of coding it up, and the weakness inherent in having switches in the code, where without the alternatives there would be no switching.) For all these reasons, the history of "algorithm agility" has been rather fun for developers and rather a headache for users. For the users, there is an aspirin: http://iang.org/ssl/h1_the_one_true_cipher_suite.html For the developers, there are other fun intoxicating things to work on ;) >>> Another issue, which comes just in my mind.... would it make sense >> to >>> add support for stacked encryption? >>> I mean, having a literal packet encrypted with a symmetrically >> encrypted >>> data packet say with cipher A, which in turn is encrypted with >> another >>> symmetrically encrypted data packet say with cipher B. >>> Of course the session key packet would have to be large enough to >>> provide key material for both. >> >> What problem are you trying to solve? People have done that before. >> You could build this up in an only slightly klugy manner with existing >> OpenPGP components. > No specific, problem,... I'd just like to see that OpenPGP allows for > even more higher-grade security. I mean really for a very long time > scale. > In in case one cipher is broken (ok I know that this is rather unlikely) > the other ciphers might be still safe (when multiple are used). This is a tricky area. By trying to create a stronger cipher (and that is what you are doing, combining A + B to make cipher C) you are putting yourself above the cryptographers ... who presumably tried to make A and B quite strong already. ( I for one do that all the time -- put myself above the cryptographers. But only in my area of expertise, which is computer science, and not in their area of expertise, which is cryptography! :) I have seen this done with AES and another algorithm XOR'd in parallel. The conjecture is that it is then stronger than either alone. E.g., if one breaks. But this is just conjecture. Such a claim is not easily distinguishable from developers having too much fun.... > Unfortunately, OpenPGP development seems to be quite slowed down to me. > Of course this has advantages but on the other hand I'd like to see many > things that were previously discussed here, e.g. > - PBKDF2 > - phasing out SHA1 > - ECC (ok this is on its way :) ) > - some of the ideas presented in the threads "Series of minor questions > about OpenPG" here, especially: > - making the standard more strict in several aspects and work against > possible ambiguities. > - much more use of the user attribute packet (which IMO should replace > the User ID packet on a long term scale), adding _many_ possible values > that can be signed,... e.g. things like brithday (time), birthplace, > color of eyes ;) ... much more types of names (a common name which would > be about what we have right now in the user ID, family name and given > name (for western contries), other types for different cultures) ... I > could even think of stuff like address and so on. mmmm possibly. I wrote a while ago that (IMHO) we should not try and fiddle with the current OpenPGP structures, instead we should finish the RFC ... then start a complete rewrite. The reason for this is that OpenPGP includes the best of our understanding from a long time ago. Around PGP 5, etc. And in the last decade we've learnt a lot more ... which we're probably missing out on if we spend another decade tuning PGP 5 :) iang Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7QNpNvN058929 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 26 Aug 2010 16:51:23 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7QNpNFV058928; Thu, 26 Aug 2010 16:51:23 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from walrus.jabberwocky.com (walrus.jabberwocky.com [173.9.29.57]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7QNpLH5058922 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 26 Aug 2010 16:51:22 -0700 (MST) (envelope-from dshaw@jabberwocky.com) Received: from grover.home.jabberwocky.com (grover.home.jabberwocky.com [172.24.84.28]) by walrus.jabberwocky.com (8.14.3/8.14.3) with ESMTP id o7QNpKVt024085; Thu, 26 Aug 2010 19:51:21 -0400 Subject: Re: SERPENT in OpenPGP? Mime-Version: 1.0 (Apple Message framework v1081) Content-Type: text/plain; charset=us-ascii From: David Shaw In-Reply-To: <1282862498.18783.20.camel@fermat.scientia.net> Date: Thu, 26 Aug 2010 19:51:20 -0400 Cc: OpenPGP Working Group Message-Id: <8FA2B319-DA31-4262-A3AB-98BF4A85C4A2@jabberwocky.com> References: <1282856536.11340.29.camel@fermat.scientia.net> <3C0E8216-05E0-4E92-BC30-9B63CAEADF59@callas.org> <1282862498.18783.20.camel@fermat.scientia.net> To: Christoph Anton Mitterer X-Mailer: Apple Mail (2.1081) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by hoffman.proper.com id o7QNpNH4058924 Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: On Aug 26, 2010, at 6:41 PM, Christoph Anton Mitterer wrote: >> If you wanted to write an RFC for Serpent, go for it. Look at the one >> for Camillia as a guide and plagiarize all that you need. > Well a) I'm not sure whether David would be very happy if I plagiarize > his work ;) b) I don't consider myself to be enough of a crypto-guru > and/or expert in the RFC/ID writing mechanisms to do that c) without > support form the community/WG,... this has rather limited changes (IMO). I don't know that you need my permission, but in any event by all means please do plagiarize it. Frankly, you could make a Serpent draft in short order by simply replacing the string "Camellia" with "Serpent" and changing the references. Most of the text there applies just as well to Serpent as it does to Camellia. I can send you the XML source to the draft if you like - xml2rfc handles all the RFC formatting and boilerplate for you. David Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7QMfjFN056350 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 26 Aug 2010 15:41:45 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7QMfjXk056349; Thu, 26 Aug 2010 15:41:45 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from mailgw02.dd24.net (mailgw02.dd24.net [193.46.215.43]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7QMfhKr056343 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO) for ; Thu, 26 Aug 2010 15:41:44 -0700 (MST) (envelope-from calestyo@scientia.net) Received: from localhost (amavis02.dd24.net [192.168.1.113]) by mailgw02.dd24.net (Postfix) with ESMTP id 54A353544E4 for ; Thu, 26 Aug 2010 22:41:43 +0000 (GMT) X-Virus-Scanned: domaindiscount24.com mail filter gateway Received: from mailgw02.dd24.net ([192.168.1.197]) by localhost (amavis02.dd24.net [192.168.1.106]) (amavisd-new, port 10197) with ESMTP id VL4+hGowhSSJ for ; Thu, 26 Aug 2010 22:41:38 +0000 (GMT) Received: from [192.168.0.100] (ppp-93-104-127-141.dynamic.mnet-online.de [93.104.127.141]) by mailgw02.dd24.net (Postfix) with ESMTPA id C47593540AB for ; Thu, 26 Aug 2010 22:41:38 +0000 (GMT) Subject: Re: SERPENT in OpenPGP? From: Christoph Anton Mitterer To: OpenPGP Working Group In-Reply-To: <3C0E8216-05E0-4E92-BC30-9B63CAEADF59@callas.org> References: <1282856536.11340.29.camel@fermat.scientia.net> <3C0E8216-05E0-4E92-BC30-9B63CAEADF59@callas.org> Content-Type: text/plain; charset="UTF-8" Date: Fri, 27 Aug 2010 00:41:38 +0200 Message-ID: <1282862498.18783.20.camel@fermat.scientia.net> Mime-Version: 1.0 X-Mailer: Evolution 2.30.3 Content-Transfer-Encoding: 7bit Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: On Thu, 2010-08-26 at 15:00 -0700, Jon Callas wrote: > OpenPGP has Twofish, for which pretty much all the same things can be > said. If you don't like AES, you should likely be using Twofish or > Serpent. OpenPGP happens to have Twofish in it. Yes I know... Just don't see the reason why OpenPGP is rather conservative with it's implemented algorithms. Not only for ciphers, but also e.g. compression algorithms (supporting XZ would IMHO make sense). > > If you wanted to write an RFC for Serpent, go for it. Look at the one > for Camillia as a guide and plagiarize all that you need. Well a) I'm not sure whether David would be very happy if I plagiarize his work ;) b) I don't consider myself to be enough of a crypto-guru and/or expert in the RFC/ID writing mechanisms to do that c) without support form the community/WG,... this has rather limited changes (IMO). > > Another issue, which comes just in my mind.... would it make sense > to > > add support for stacked encryption? > > I mean, having a literal packet encrypted with a symmetrically > encrypted > > data packet say with cipher A, which in turn is encrypted with > another > > symmetrically encrypted data packet say with cipher B. > > Of course the session key packet would have to be large enough to > > provide key material for both. > > What problem are you trying to solve? People have done that before. > You could build this up in an only slightly klugy manner with existing > OpenPGP components. No specific, problem,... I'd just like to see that OpenPGP allows for even more higher-grade security. I mean really for a very long time scale. In in case one cipher is broken (ok I know that this is rather unlikely) the other ciphers might be still safe (when multiple are used). Unfortunately, OpenPGP development seems to be quite slowed down to me. Of course this has advantages but on the other hand I'd like to see many things that were previously discussed here, e.g. - PBKDF2 - phasing out SHA1 - ECC (ok this is on its way :) ) - some of the ideas presented in the threads "Series of minor questions about OpenPG" here, especially: - making the standard more strict in several aspects and work against possible ambiguities. - much more use of the user attribute packet (which IMO should replace the User ID packet on a long term scale), adding _many_ possible values that can be signed,... e.g. things like brithday (time), birthplace, color of eyes ;) ... much more types of names (a common name which would be about what we have right now in the user ID, family name and given name (for western contries), other types for different cultures) ... I could even think of stuff like address and so on. Cheers, Chris. Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7QM0fdk054634 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 26 Aug 2010 15:00:41 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7QM0fqs054633; Thu, 26 Aug 2010 15:00:41 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from merrymeet.com (merrymeet.com [66.93.68.160]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7QM0ebS054627 for ; Thu, 26 Aug 2010 15:00:40 -0700 (MST) (envelope-from jon@callas.org) Received: from localhost (localhost [127.0.0.1]) by merrymeet.com (Postfix) with ESMTP id 240DE2E025 for ; Thu, 26 Aug 2010 15:00:45 -0700 (PDT) Received: from merrymeet.com ([127.0.0.1]) by localhost (host.domain.tld [127.0.0.1]) (amavisd-maia, port 10024) with ESMTP id 29375-04 for ; Thu, 26 Aug 2010 15:00:26 -0700 (PDT) Received: from keys.merrymeet.com (keys.merrymeet.com [66.93.68.161]) (Authenticated sender: jon) by merrymeet.com (Postfix) with ESMTPA id 690912E071 for ; Thu, 26 Aug 2010 15:00:26 -0700 (PDT) Received: from [17.244.2.229] ([17.244.2.229]) by keys.merrymeet.com (PGP Universal service); Thu, 26 Aug 2010 14:54:31 -0700 X-PGP-Universal: processed; by keys.merrymeet.com on Thu, 26 Aug 2010 14:54:31 -0700 Subject: Re: SERPENT in OpenPGP? Mime-Version: 1.0 (Apple Message framework v1081) From: Jon Callas In-Reply-To: <1282856536.11340.29.camel@fermat.scientia.net> Date: Thu, 26 Aug 2010 15:00:17 -0700 Cc: OpenPGP Working Group Message-Id: <3C0E8216-05E0-4E92-BC30-9B63CAEADF59@callas.org> References: <1282856536.11340.29.camel@fermat.scientia.net> To: Christoph Anton Mitterer X-Mailer: Apple Mail (2.1081) X-PGP-Encoding-Format: Partitioned X-PGP-Encoding-Version: 2.0.2 X-Content-PGP-Universal-Saved-Content-Transfer-Encoding: quoted-printable X-Content-PGP-Universal-Saved-Content-Type: text/plain; charset=us-ascii Content-Type: text/plain; charset="us-ascii" X-Virus-Scanned: Maia Mailguard Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from QUOTED-PRINTABLE to 8bit by hoffman.proper.com id o7QM0ebS054629 Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Aug 26, 2010, at 2:02 PM, Christoph Anton Mitterer wrote: > > Hi. > > Have it ever been considered to add SERPENT to OpenPGP? > > AFAIK it's free/patent-unencumbered,... and IIRC the AES process, it was > considered to be even more secure than Rijndael.... of course it's > probably far less analysed than the later. OpenPGP has Twofish, for which pretty much all the same things can be said. If you don't like AES, you should likely be using Twofish or Serpent. OpenPGP happens to have Twofish in it. If you wanted to write an RFC for Serpent, go for it. Look at the one for Camillia as a guide and plagiarize all that you need. > > > Another issue, which comes just in my mind.... would it make sense to > add support for stacked encryption? > I mean, having a literal packet encrypted with a symmetrically encrypted > data packet say with cipher A, which in turn is encrypted with another > symmetrically encrypted data packet say with cipher B. > Of course the session key packet would have to be large enough to > provide key material for both. What problem are you trying to solve? People have done that before. You could build this up in an only slightly klugy manner with existing OpenPGP components. Jon -----BEGIN PGP SIGNATURE----- Version: PGP Universal 2.10.0 (Build 554) Charset: us-ascii wj8DBQFMduKXsTedWZOD3gYRAhLDAJ4hAZ09zSm2dx9GXhYZfaY2WD/zrwCgxErW fi1e0+HmQ5pWwSevaRp7GuA= =Fb4X -----END PGP SIGNATURE----- Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7QL2Poe051730 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 26 Aug 2010 14:02:25 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7QL2PO3051728; Thu, 26 Aug 2010 14:02:25 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from mailgw02.dd24.net (mailgw02.dd24.net [193.46.215.43]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7QL2Np7051720 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO) for ; Thu, 26 Aug 2010 14:02:24 -0700 (MST) (envelope-from calestyo@scientia.net) Received: from localhost (amavis01.dd24.net [192.168.1.111]) by mailgw02.dd24.net (Postfix) with ESMTP id 93A443540FC for ; Thu, 26 Aug 2010 21:02:21 +0000 (GMT) X-Virus-Scanned: domaindiscount24.com mail filter gateway Received: from mailgw02.dd24.net ([192.168.1.197]) by localhost (amavis01.dd24.net [192.168.1.105]) (amavisd-new, port 10197) with ESMTP id Jty+ZYGbHMwD for ; Thu, 26 Aug 2010 21:02:17 +0000 (GMT) Received: from [192.168.0.100] (ppp-93-104-127-141.dynamic.mnet-online.de [93.104.127.141]) by mailgw02.dd24.net (Postfix) with ESMTPA id 68C443540AB for ; Thu, 26 Aug 2010 21:02:17 +0000 (GMT) Subject: SERPENT in OpenPGP? From: Christoph Anton Mitterer To: ietf-openpgp@imc.org Content-Type: text/plain; charset="UTF-8" Date: Thu, 26 Aug 2010 23:02:16 +0200 Message-ID: <1282856536.11340.29.camel@fermat.scientia.net> Mime-Version: 1.0 X-Mailer: Evolution 2.30.3 Content-Transfer-Encoding: 7bit Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: Hi. Have it ever been considered to add SERPENT to OpenPGP? AFAIK it's free/patent-unencumbered,... and IIRC the AES process, it was considered to be even more secure than Rijndael.... of course it's probably far less analysed than the later. Another issue, which comes just in my mind.... would it make sense to add support for stacked encryption? I mean, having a literal packet encrypted with a symmetrically encrypted data packet say with cipher A, which in turn is encrypted with another symmetrically encrypted data packet say with cipher B. Of course the session key packet would have to be large enough to provide key material for both. Cheers, Chris. Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7EEWIMw053592 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sat, 14 Aug 2010 07:32:18 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id o7EEWIND053591; Sat, 14 Aug 2010 07:32:18 -0700 (MST) (envelope-from owner-ietf-openpgp@mail.imc.org) X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-ietf-openpgp@mail.imc.org using -f Received: from mail-yw0-f43.google.com (mail-yw0-f43.google.com [209.85.213.43]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id o7EEWHQs053586 for ; Sat, 14 Aug 2010 07:32:17 -0700 (MST) (envelope-from singpolyma@gmail.com) Received: by ywf7 with SMTP id 7so1605549ywf.16 for ; Sat, 14 Aug 2010 07:32:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:sender:date:from:to:subject :message-id:mime-version:content-type:content-disposition:jabber-id :openpgp:x-url:user-agent; bh=ykSaKbLwvrTc5LcKQ1z6oJfRMQbHiqNDlmk1ajTJ2K4=; b=FGMyDQeo3tFvflV6jTWQcc4ayU4dfip3zn864kfDQcfDWjryA5hNXBUh7uZ2KKnSw6 /HQPTR3bjkP+SK+RdIcGpDRrO/emBAsws6+R8tZS8q6+9CUn9hTzlzGNoZFiAyefxvun W8NjFR4p6wYLGFm/ievK6lfzZQHB2inL5kxrg= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=sender:date:from:to:subject:message-id:mime-version:content-type :content-disposition:jabber-id:openpgp:x-url:user-agent; b=gz+l50uMBdR8esd46rDPpoQ4zX6xOkBLmrX0LfZvIY3Ea26cxRc78g3ezW3CnLbHrL 4XjHe+Y06PmdF63s2RXuuTVwcoB+gWS2KuEcBm1Pm31qvRgt7hLNTcXJZ89kT1mmH5cA KcrMfmt3XC5r8aLKZZvygLMUwNlgj3fN3fNG4= Received: by 10.150.160.2 with SMTP id i2mr3531005ybe.314.1281796335468; Sat, 14 Aug 2010 07:32:15 -0700 (PDT) Received: from localhost (dsl-173-248-208-49.acanac.net [173.248.208.49]) by mx.google.com with ESMTPS id u41sm2167498yba.1.2010.08.14.07.32.13 (version=TLSv1/SSLv3 cipher=RC4-MD5); Sat, 14 Aug 2010 07:32:14 -0700 (PDT) Date: Sat, 14 Aug 2010 09:32:11 -0500 From: Stephen Paul Weber To: ietf-openpgp@imc.org Subject: Certification/self-signatures Message-ID: <20100814143211.GA1530@singpolyma-svelti> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; x-action=pgp-signed Content-Disposition: inline Jabber-ID: singpolyma@gmail.com OpenPGP: id=CE519CDE; url=https://singpolyma.net/public.asc X-URL: https://singpolyma.net User-Agent: Mutt/1.5.20 (2009-06-14) Sender: owner-ietf-openpgp@mail.imc.org Precedence: bulk List-Archive: List-Unsubscribe: List-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hello all! I'm seeking some clarification WRT computing v4 signatures over key data for 0x13 signatures (specifically, the self-signature). The spec says "0x99, followed by a two-octet length of the key, and then body of the key packet". I assume it's always on what would be the body of the public part of the packet? Is this the same as the data used in generating the fingerprint, just without version/timestamp/algorithm octets? Should the length field include the length of the 0x99 + length in it? Should it include the length of the whole public park (including version/timestamp/algorithm)? Then it says "A certification signature (type 0x10 through 0x13) hashes the User ID being bound to the key into the hash context after the above data ... A V4 certification hashes the constant 0xB4 for User ID certifications or the constant 0xD1 for User Attribute certifications, followed by a four-octet number giving the length of the User ID or User Attribute data, and then the User ID or User Attribute data." So, 0xB4 + 4-octet-length + user-id-packet-body ? The pseudocode I'm working with now (which isn't working) is: - ---- material = key_fields.map { |key_field| bitlength(key[key_field]) + key[key_field] }.join 0x99 + material.length + material + 0xB4 + user_id.body.length + user_id.body - ---- - -- Stephen Paul Weber, @singpolyma See for how I prefer to be contacted edition right joseph -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQIcBAEBCAAGBQJMZqjrAAoJENEcKRHOUZzerpsQAKXYwDdcf1hO8BKGd+AkA0CO 3lWWM/lFgo3ho0gqxDoni9Y3E4eT2VBSJ3mKXrRv0CNy6udyU88rSFECDvcz54CI Z6nf34DKlTbSpfYuR2/8n+bMhUZR/rnRhmj1Vdmxkz2VuheReWyUn1pEMBx3n4HT bVymy9KRQn3qZbR5UT5P8DL7xzLucful00V9aFtTC6CxC2ZHKUNl6RMDH0sPHY4o GEmdnVnlR0VREOgBqPCzAZV3/zcZ+aBqpj7mEi6AtRGvy0Dvi1Pv5YiSgp2tuNDZ Jv0j6G58NB5MqQWtfMttCLQDGhu6K4FNah+X6QSV2j86H00luSCQSSXB05kmd5Tw NSu4ZwjdLJOhCJDivI3LajvFKmCFLBsRZf6G1SmeP1zvv4OHMdw0MeG3g93/3M9V gfpOVi0tvgH8806M77+N/TdBBHrPmqteK4jHAed7NQ6jj0SGdKxp/h0XEfceSQ7w MmvrJkXS8m7MVIRCv9599a/DoKPbLmhXqsH4Fuo6AfmgdOiaNxt6vJDy7nuQdosN fZYekGZtpe2Dmj2NgRbz4pamlm6tuMRqsa1t7Q4jViisf4scB7ecV1FX8izFg/nZ 0wDsBb/FzSZTmZYn1zJvDpzy62JOvDGhnGNrGPmSCJxohUNAFr4b2DJq4nRnbm9F HnVT5e67gsVBXm4Tzz6j =Pt+h -----END PGP SIGNATURE-----