Subject: Re: [openpgp] [RFC4880bis PATCH] Drop "Compatibility Profiles" section.

From: Paul Wouters <[email-masked]>
Date: Wed, 28 Apr 2021 23:58:48 -0400 (EDT)

On Sat, 27 Mar 2021, Ángel wrote:

>> And that the place within the document might be right too?
>
> That's an editorial matter, but I don't think so. I find the security
> section to contain many things without a clear script, just a mixture
> of things related to security. The problem is that most of the rfc has
> some relation to security :-)
> There are rfcs with only a few security points to note. Having a
> section listing all of them is good. But I don't think that's suitable
> for OpenPGP.
>
> I would prefer to see as little as possible on the Security
> Considerations, with the points within the most relevant section to the
> topic. See for example how I positioned the line about you MUST use
> Iterated and salted s2k at the part discussing rather than in that
> generic section. IMHO that makes more sense, instead of having a S2K
> requisite in a complete separate part of the document.

> Nevertheless, the Security Considerations need an overhaul. There are

This is a good point and I've added this as an issue:

https://gitlab.com/openpgp-wg/rfc4880bis/-/issues/29

>>> (*) A phrase that got removed but should be recovered is «MDC MUST be
>>> used when a symmetric encryption key is protected by ECDH.». I pondered
>>> where to move it, but I concluded that should better go at its own
>>> changeset stating that new algorithms cannot be used without MDC i.e.
>>> they cannot be used with the "Symmetrically Encrypted Data Packet"
>>> (still somewhat redundant, as that one MUST NOT be created).
>>
>> If others agree, we need a tracking item for this too?
>
> Yes, probably. Unless we get a quick consensus on this topic.

We did not, so I opened a tracking item for this too:

https://gitlab.com/openpgp-wg/rfc4880bis/-/issues/30

>>> Additionally, the phrase "A compliant application MUST only use
>>> iterated and salted S2K"... is also mostly fine, but I had already
>>> covered a proposal for that one in the previous
>>> https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/42
>>
>> I would need to hear from more people about this change to see if
>> there is consensus for this.
>>
>> speaking with no roles others than an individual:
>
> This part was proposed in February on a different thread. I am moving
> your comment there and replying in that one:
>
> https://mailarchive.ietf.org/arch/msg/openpgp/ml5gzuQtSY6ANBejs8Xk66x_abQ

I've merged in this change in a seperate commit, please review as part
of the next draft update. (commit 464ac8232f9)

Paul

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Thu, 29 Apr 2021 11:57:32 -0400

> of the next draft update. (commit 464ac8232f9)

I think the commit you're talking about is now public as
1edfd5d45a49a5a15d08eff9fff7d5c482acb6da, 'update text on "Simple S2K
and Salted S2K specifiers" as per WG discussion'.

minor clarification: among a few other changes, it adds this line:

+Implementations SHOULD NOT use these methods on encryption of both keys and messages.

I think this "both" should be "either" -- otherwise, the guidance sounds
like it applies only to some combination encryption (which isn't
possible iirc).  otherwise, it looks good to me.

         --dkg