Subject: Re: Twofish

From: Jon Callas <[email-masked]>
Date: Tue, 12 Jan 1999 12:23:20 -0800

Both Werner Koch and his GNUPG team and the NAI PGP team are planning on
putting Twofish (256-bit key) in versions of their respective OpenPGP
programs. Consequently, we need to agree on a constant for it. I propose we
use 8 (eight) as it's the next one in line.

Comments? Discussion?

	Jon

-----
Jon Callas                                  [email-masked]
CTO, Total Network Security                 3965 Freedom Circle
Network Associates, Inc.                    Santa Clara, CA 95054
(408) 346-5860                              
Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS)
              665B 797F 37D1 C240 53AC 6D87 3A60 4628           (RSA)

---

From: Max Inux <[email-masked]>
Date: Tue, 12 Jan 1999 16:03:36 -0800 (PST)

>use 8 (eight) as it's the next one in line.

I dont know about NAI, but from what Werner has said on the GPG list he
intends to remove Blowfish, which makes sense, I dont know about anyone
else but I have yet to see anyone use Blowfish, so why not just pretend it
was not there and just go with twofish?  after AES is done, it surely will
have been proven.

-MaxInux aka William Tiemann
Max <[email-masked]> New PGP Keys Available
       If crypto is outlawed only outlaws will have crypto.
1960 Ford Falcon Tudor Daily Driver, Dont you just wish you had one?

---

From: uri <[email-masked]>
Date: Tue, 12 Jan 1999 19:28:17 -0500 (EST)

Max Inux says:
> >programs.............. Comments? Discussion?
>

I second this. How many ciphers do we need, after all? We aren't in the
contest "who can support more", right?

So, Twofish is a logical successor for Blowfish - and let's treat it
like that. If people have Blowfish-encrypted stuff already (which I
doubt, but you never know) - they can do a one-time move. Better
than to carry unnecessary baggage.
-- 
Regards,
Uri		[email-masked]
-=-=-=-=-=-=-
<Disclaimer>

---

From: Jon Callas <[email-masked]>
Date: Tue, 12 Jan 1999 16:49:27 -0800

At 07:28 PM 1/12/99 -0500, uri wrote:

I'm uncomfortable with re-declaring an identifier. It's just not good
engineering practice to my mind. I think it is much better use another
identifier. This would only put us up to 10, and that includes four
identifiers that are presently only reserved. If 2440 were not out, I'd
have no problem. But it is out there, and it just bugs me to redeclare an
identifier if it inconveniences even a single user.

By the bye, an inconvenient page break in 2440 made me say something stupid
in my last message. The identifier should be 10, not 8. 

	Jon

-----
Jon Callas                                  [email-masked]

---

From: William Lewis <[email-masked]>
Date: Tue, 12 Jan 99 17:08:02 -0800

> was not there and just go with twofish?  after AES is done, it surely will

It's asking for trouble to have an ambiguous assigned number. If there were  
a shortage of available numbers, reusing Blowfish's might make sense; but  
there isn't, and if someday there is, Blowfish's number can be reused then.

The argument that Twofish is Blowfish's successor doesn't hold water, IMHO.  
Twofish won't decrypt a message encrypted with Blowfish, so they're different  
algorithms, despite sharing authorship or structure.

---

From: [email-masked]
Date: Wed, 13 Jan 1999 13:22:08 -0500

> in my last message. The identifier should be 10, not 8. 

10 would be better.  I already have blowfish in my implmentation even if
no one uses it.

Also, as someone else pointed out, we need to have established key lengths
AND I assume that it will be in the ECB mode with the PGP cfb with reset
at 10 bytes like everything else?

Does anyone have an implementation, or at least what calls they are using
if they are using the counterpane reference source?

---

From: Werner Koch <[email-masked]>
Date: Wed, 13 Jan 1999 20:10:45 +0100

> 10 would be better.  I already have blowfish in my implmentation even if

GnuPG uses Blowfish too.

> if they are using the counterpane reference source?

Actually GnuPG has a Twofish (128 bit key) implemenation as
experimental algorithm.

  Werner

---

From: Andrew Bromage <[email-masked]>
Date: Thu, 14 Jan 1999 10:19:30 +1100 (EST)

G'day all.

Jon Callas wrote:

> engineering practice to my mind.

I have to agree.

RFC 2440, the current "standard", is published.  If we were looking at
an error, I'd say "fix it".  But we are not The Evil Software Empire(tm),
and can't move the ground out from under people.  This kind of ambiguity
will only cause confusion at best and put people off PGP at worst.

> I think it is much better use another
> identifiers that are presently only reserved.

...and one would be deprecated.

Cheers,
Andrew Bromage

---

From: Max Inux <[email-masked]>
Date: Wed, 13 Jan 1999 19:08:10 -0800 (PST)

Upon greater light being shed on the subject, I vote that identifier 10 be
TwoFish and 11 be whatever wins AES, if it is TwoFish it will be
un-needed.

Now the problem is the bit size, looking at how we have other stuff done
(Block size = 64 bit, key size = 128), it seems fitting that if Block size
=128 we have key size = 256

---

From: Jon Callas <[email-masked]>
Date: Thu, 14 Jan 1999 14:43:35 -0800

At 07:08 PM 1/13/99 -0800, Max Inux wrote:

We already reserved three for AES in 2440, for 128, 192, and 256 bit key
lengths, so we're already covered.

	Jon

-----
Jon Callas                                  [email-masked]

---

From: Jon Callas <[email-masked]>
Date: Mon, 18 Jan 1999 23:59:42 -0800

I spoke to Bruce today about what key length to use. I asked him because a
few months ago we had a casual conversation and he said he was more
confident of Twofish at 128 bits than 256 bits. I brought it up again,
mentioning we're discussing putting it in OpenPGP (and he is delighted
about that).

Anyway, he first said to do it at 128 bits and then said, "Wait a minute --
it doesn't cost you anything to go to the full 256?" and I said it didn't.
"Then do 256" he replied.

I discussed our previous conversation, and he said that his doubt is merely
that he is not convinced that the 256-bit keys are fully exponentially
stronger than 128. I think this is reasonable, and have the same doubts
myself about all the present generation 256 bit cyphers. So no biggie, really.

Does anyone *not* want to do 256? Send me private mail if you don't want to
be seen as a party-pooper, but have concerns. I launder information real well.

	Jon

-----
Jon Callas                                  [email-masked]

---

From: Andrew Bromage <[email-masked]>
Date: Wed, 20 Jan 1999 13:30:54 +1100 (EST)

G'day all.

Jon Callas wrote:

> myself about all the present generation 256 bit cyphers.

Quite.  We have a precedent in our requirement of 3DES which is
vulnerable to a meet-in-the-middle attack, so we don't expect it to
be fully exponentially stronger than a modern 128 bit cipher.

Cheers,
Andrew Bromage