Subject: RE: A question on Twofish / AES / PGP

From: "Simpson, Sam" <[email-masked]>
Date: Tue, 9 Mar 1999 10:38:40 +0000

Many thanks to all the people who replied (and set me straight on
several issues).

I won't reply individually to save list bandwidth, but I have a
few comments:

William H. Geiger III wrote:

> Well IMHO we have enough good symetric cyphers in there right
now:

I agree totally!  There is no (IMHO) rush to add algorithms.  I
am not convinced that Twofish is special enough (sorry Bruce!) to
make an exception to add it to the OpenPGP standard at this
point.

Jon Callas wrote:
> Two groups of developers, the NAI/PGP group and the GNU Privacy
Guard
> group, have each said that they want to put Twofish into their
> implementations.[...]

Is there a document somewhere detailing the selection criteria or
was it a "gut-feel"?  (Not that "gut-feels" are totally a bad
thing...)

> If you disagree strongly, and believe that the consensus has 
> gone the wrong way, keep arguing!

I do disagree with the special status that's being given to
Twofish (or rather, I'd like to know the rationale), but since
I'm new to this forum I'm not going to upset people on an issue
that this has been previously discussed and agreed upon.

I agree totally with your point that the "receiver chooses the
algorithms" - but will users have the sense not to switch Twofish
on (or switch it off if it's going to be on by default) -
especially in view of the "trendy" status of Twofish.

Werner Koch wrote:

> According to Schneier, we should replace
> Blowfish by Twofish right now because he (and others too)
trusts
> Thwofish more.

This appears to be contra advice given by Schneier in sci.crypt,
but anyway.....

Again, many thanks for your thoughtful & polite replies.  It is
my intention to remain subscribed to this list, so I look forward
to speaking to you all more in future.

Fond regards,

Sam Simpson
Communications Analyst
- -- http://www.scramdisk.clara.net/ for ScramDisk hard-drive
encryption & Delphi Crypto Components.  PGP Keys available at the
same site.

---

From: Jon Callas <[email-masked]>
Date: Tue, 09 Mar 1999 13:48:13 -0800

At 10:38 AM 3/9/99 +0000, Simpson, Sam wrote:
|Is there a document somewhere detailing the selection criteria or
|was it a "gut-feel"?  (Not that "gut-feels" are totally a bad
|thing...)
|

It was gut feel.

	Jon

-----
Jon Callas                                  [email-masked]
CTO, Total Network Security                 3965 Freedom Circle
Network Associates, Inc.                    Santa Clara, CA 95054
(408) 346-5860                              
Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS)
              665B 797F 37D1 C240 53AC 6D87 3A60 4628           (RSA)