Subject: Re: Further deprecating PGP2

From: [email-masked] (Peter Gutmann)
Date: Sun, 9 Mar 2003 19:27:16 +1300

Jeroen van Gelderen <[email-masked]> writes:

>How can my copy of OpenPGP support an IDEA-encrypted message if I am not
>allowed to use IDEA to decrypt it? 

How many people are really going to be affected by this?  As I said in my
previous message, I would imagine that the majority of people still using 2.x
are individuals/personal-use, which means they have no problems using IDEA.
Commercial users will (presumably) be using a licensed version, in which case
it doesn't matter either.  You need to distinguish between "We can't use IDEA
for commercial/licensing reasons" and "We refuse to consider IDEA for
ideological reasons".  I suspect instances of the former are pretty rare in
practice.  Give me some real-world examples where significant use of PGP was
affected by the current situation with IDEA, and show me how MUST NOT IDEA
would have fixed this.

Peter.

---

From: Jeroen van Gelderen <[email-masked]>
Date: Sun, 9 Mar 2003 02:11:02 -0500

On Sunday, Mar 9, 2003, at 01:27 US/Eastern, Peter Gutmann wrote:

> How many people are really going to be affected by this?

Any implementor of an OpenPGP-compliant application. As long as I 
'SHOULD' handle IDEA-encrypted mail people will consider my application 
to be incomplete if it doesn't.

Anybody who uses -say- the Cryptix OpenPGP library in a commercial 
setting will have to get themselves a license or disable the IDEA 
functionality.

For what? For people who insist on using outdated and deprecated 
software? Why would they expect a modern standard to cater for them?

Why not get rid of IDEA? People MAY implement IDEA/PGP2-support in 
their otherwise OpenPGP-compliant applications. Such an extra feature 
will not render the application non-compliant. But rip the 'SHOULD' out 
of the standard. Make sure that people who send PGP2 messages do 
realize that they are not sending OpenPGP messages and that they cannot 
expect OpenPGP compliant apps to deal with them. In particular, let's 
make very clear that they cannot expect a PGP2 response back.

>   As I said in my

Then they don't care about their use of IDEA being OpenPGP-endorsed or 
not. I do care about the fact that I am not legally allowed to decrypt 
their messages when I receive them. And you are giving them the 
ammunition to say "Hey, my message is OpenPGP compliant!".

The issue is not them. The issue is that everybody else 'SHOULD' handle 
their outdated messages. I don't care what you use or do, I care about 
what I am supposed to do according to the standard. And according to 
the standard I 'SHOULD' support a long-deprecated type of message and 
thus I 'SHOULD' pay royalties.

I want *every* OpenPGP implementation to be able to handle OpenPGP 
messages without paying royalties to anyone. And thus do I want 
IDEA-encrypted messages to not carry the OpenPGP seal of approval. 
There is no need for that.

> ideological reasons".

That is easy for you to say. You can create an IDEA-message for free 
because you don't work in a commercial setting. I can't legally decrypt 
your IDEA/OpenPGP message because I don't have an IDEA license. What 
kind of interoperability is that?

The point is that using the full standard including 'SHOULD's in a 
commercial setting requires money. That has nothing to do with 
ideology. Zip. Zilch. Principle, yes. But not ideology. Internet 
standards are kept patent free for practical reasons, not ideological 
reasons.

Wasn't it you who called for a patent-free OCB? Why was that again?

Cheers,
-J

---

From: Jeroen van Gelderen <[email-masked]>
Date: Sun, 9 Mar 2003 02:34:44 -0500

On Sunday, Mar 9, 2003, at 01:27 US/Eastern, Peter Gutmann wrote:

> it doesn't matter either.

In which case either party doesn't care about their messages not being 
branded OpenPGP compliant because they will be sending the messages to 
other 2.x users. So PGP2 messages can be stripped out of the standard 
that contemporary PGP users adhere to.

>  You need to distinguish between "We can't use IDEA
> practice.  Give me some real-world examples

I am not exactly sure how you are interpreting "I don't want to require 
people to pay" as "I have an issue with patents". Iff the latter were 
true I would object against CAST-5 too.

I have a reasonably large set of PGP messages that I can't legally 
decrypt because they are encrypted with IDEA. Those messages should not 
be considered OpenPGP compliant. Most people who sent those have now 
switched to GNUPG.

I think that in practice most people ignore the IDEA patent because 
Ascom is pretty lenient. Or companies like PGP buy a wholesale license 
on their behalf. But anyone who is using GnuPG in a commercial setting 
cannot legally decrypt IDEA messages without a license. Which means 
they cannot decrypt OpenPGP-compliant messages. So we should make sure 
they don't end up in that situation. They should be able to say "Hey, 
please send me an OpenPGP message instead!".

There is a reason that Internet standards tend to be completely patent 
free. OpenPGP is no exception.

>  where significant use of PGP was

The MUST NOT was not a central point of my argument. The central point 
was changing the SHOULD to MAY. People SHOULD NOT actively support 
PGP2, they MAY do so however. It is the difference between it being 
optional (MAY) and desirable (SHOULD). It's time to kill of the old 
baggage to reduce complexity. And definitely if it costs money.

I doubt PGP use was ever 'significant'. I was hoping that simplifying 
the standard and ripping out the old baggage would give OpenPGP a push 
in the right direction. Implementing OpenPGP is horrific enough as-is.

Cheers,
-J