Subject: [IPP] IPP Encrypted Jobs and Documents: Maybe Not Dead Yet

From: Michael Sweet <[email-masked]>
Date: Mon, 04 Jun 2018 08:01:14 -0400

All,

The PGP folks have been discussing the EFAIL paper:

    https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060315.html

In short, PGP has supported a "MDC" mode which is used to provide protection similar to GCM, and email clients are ignoring warnings (which IMHO should be hard PGP errors unless the user explicitly says to override the checks) and not validating multi-part MIME messages.

It *does* look like S/MIME is still compromised for the time being, but perhaps we can still move forward just using PGP (which was the original plan anyways...)

_________________________________________________________
Michael Sweet, Senior Printing System Engineer

_______________________________________________
ipp mailing list
[email-masked]
https://www.pwg.org/mailman/listinfo/ipp

---

From: "Kennedy, Smith (Wireless & Standards Architec)" <[email-masked]>
Date: Tue, 5 Jun 2018 23:28:21 +0000

Hi Mike,

This seems like good news! That made me realize something: as a new usage context for PGP, we CAN require the most stringent level of security and not be worried about backward compatibility. In other words, we don't have to be grandfathering in all the old stuff in PGP - we can require the best set of encryption primitives currently available and baseline on that, and abandon all the older and weaker tech.

Smith

/**
    Smith Kennedy
    Wireless & Standards Architect - IPG-PPS
    Standards - IEEE ISTO PWG / Bluetooth SIG / Wi-Fi Alliance / NFC Forum / USB-IF
    Chair, IEEE ISTO Printer Working Group
    HP Inc.
*/

> On Jun 4, 2018, at 5:01 AM, Michael Sweet <[email-masked]> wrote:
> 
> All,
>