Subject: Re: Klima/Rosa attack (was: Re: Diffs for next draft)

From: [email-masked]
Date: Fri, 24 Aug 2001 18:43:14 +0200

Edwin Woudt wrote:

> Jon Callas <[email-masked]> replied:
> >
> > I think an S2K that includes a hash is only mildly hackish, myself. I'd
> > support this. I'd even support an additional one that is merely salted
> > with a hash.
> 
> 
> I disagree. As Werner Koch already pointed out, the 'correct' solution is 
> to introduce version 5 of the secret key packet. I however do not think 
> that there is any real reason for introducing a v5 public key packet, given 
> that nothing changed for public key packets.
> 
> Keeping v4 public key packets will make sure nothing is broken with regard 
> to exchanging public keys. Exchanging secret keys with older 
> implementations will be broken in both cases anyway, because of the new s2k 
> type.
> 
> Edwin

v5 seckey packet will broke seckey exchange with older versions,
while new s2k not - it will still be possible to import seckey in older ver
with aged workaround - unprotect them, export, import into older ver, protect again.

== <EOF> ==
Disastry  http://i.am/disastry/
http://disastry.dhs.org/pgp <----PGP plugins for Netscape and MDaemon
 ^--GPG for Win32 (supports loadable modules and IDEA)
 ^---PGP 2.6.3ia-multi04 (supports IDEA, CAST5, BLOWFISH, TWOFISH,
     AES, 3DES ciphers and MD5, SHA1, RIPEMD160 hashes)

---

From: Edwin Woudt <[email-masked]>
Date: Fri, 24 Aug 2001 19:23:59 +0200

[email-masked] wrote:

> while new s2k not - it will still be possible to import seckey in older
> ver with aged workaround - unprotect them, export, import into older ver,
> protect again.

Uhm... this approach will also work for v5 secret key packets: just 
unprotect and convert the packet to v4 before exporting.

Edwin

---

From: [email-masked]
Date: Fri, 24 Aug 2001 19:27:40 +0200

> unprotect and convert the packet to v4 before exporting.

it's easy to unprotect (just set passphrase to nothing) but not to convert to v4....

== <EOF> ==
Disastry
http://i.am/disastry/