Subject: (slight) Error in rfc2440

From: Jan Petranek <[email-masked]>
Date: Tue, 2 Oct 2001 17:55:46 +0200 (CEST)

Hello out there,

I just read the rfc2440 (on OpenPGP), dated from November 1998 and it seems,
there is an error in it.

In section  2.1. "Confidentiality via Encryption", it says:

"With public-key encryption, the object is encrypted using a symmetric
encryption algorithm."

I believe, it should read

"With symmetric-key encryption, the object is encrypted using a symmetric
      ^^^^^^^^^^^^^
encryption algorithm."

I believe, the author intended to talk about the symmetric encryption here,
because in the next sentences, he discusses the role of symmetric  encryption
used in OpenPGP.
Furthermore, if the key of a symmetric encryption would be public, as the
original text suggests, it would render the encryption completely worthless.

As I'm already messing with the rfc, I just as well may add this
suggestion: In the section describing the paket lenghts, the lenghts in
the text are written in decimal, where they are written in octal in the
examples (of course). It might improve readability, if in the text both
notations would be used, like
"100 (0x64) pakets will follow"

With my best whishes,

Jan Petranek

---

From: Jon Callas <[email-masked]>
Date: Tue, 2 Oct 2001 14:45:37 -0700

Thanks. I've massaged that paragraph. The new one reads:

OpenPGP combines symmetric-key encryption and public key encryption to
provide confidentiality. When made confidential, first the object is
encrypted using a symmetric encryption algorithm.  Each symmetric key is
used only once. A new "session key" is generated as a random number for
each message. Since it is used only once, the session key is bound to the
message and transmitted with it.  To protect the key, it is encrypted with
the receiver's public key. The sequence is as follows: