Subject: Re: I have a technical idea/change for the ECC draft

From: Greg Troxel <[email-masked]>
Date: Wed, 07 May 2008 09:39:04 -0400

"David Crick" <[email-masked]> writes:

>> What do we loose if we
>> instead use "this key replaces TrippleDES implicit algorithm with AES-128"
>> notation? This would be beneficial for RSA keys too.
>
> what if we have:
>
> Alice: {AES256, AES128, AESover3DESflag [, 3DES implicitly]}
> Bob: {3DES [, AES128 implicitly]}
>
> Then Bob or his software could legitamately choose 3DES.
>
> whereas:
>
> Alice: ECC-384/521 key with {AES256, SuiteBOnly}  and
> Alice: ECC-256 key with { [AES128 implicit], SuiteBOnly}
>
> would refuse to encrypt with anything except AES256 and
> AES128 respectively.

I think there's a fundamental mismatch between OpenPGP-style key
preferences and Suite B thinking.  As a sender, with labeled
information, you can only use approved algorithms.  Thus, if a recipient
doesn't list the approved algorithm, you just can't send them mail.  The
OpenPGP-style key preferences are in my view primarily to ensure
interoperability and allow for algorithm transitions over long
timescales.

Are we proposing sender-side rules to match labels to approved
algorithms?  It seems inadequate to put 'SuiteBOnly' as a key preference
on recipients.

---

From: Jon Callas <[email-masked]>
Date: Mon, 19 May 2008 17:00:10 -0700

> interoperability and allow for algorithm transitions over long

It's not a mismatch, you just have a language that is more expressive  
than SuiteB allows.

> algorithms?  It seems inadequate to put 'SuiteBOnly' as a key  

No, we're trying to come up with an acceptable protocol.

There are some implementers who are going to want to do SuiteB within  
OpenPGP. We should make their lives easy.

But as Werner has noted, it's not our job as an international  
community to do things that forbid flexibility. It should be  
*possible* to use ECC and Camellia, as I noted in my other message.  
The *implementation* may disallow it, but the standard should not. It  
should be possible to use ECC and Whirlpool (which people keep  
threatening to do a draft for).

A SuiteBOnly pref makes an implementer's job easier if they care about  
SuiteB. They can detect it and act accordingly. It doesn't remove the  
requirement that an implementer know what they're doing.

	Jon