Subject: Mandatory Algorithm Changes?

From: Jon Callas <[email-masked]>
Date: Tue, 8 Feb 2005 09:42:20 -0800

I almost cringe to suggest this, but I will.

Triple-DES is pretty much obsolete. Yesterday, I saw that NIST 
announced they're moving to stronger hashes.

Does anyone object to changing the MUST cipher to AES (I'd pick 128) 
and MUST hash to SHA-256?

	Jon

---

From: Werner Koch <[email-masked]>
Date: Tue, 08 Feb 2005 19:40:02 +0100

> and MUST hash to SHA-256?

Breaks interoperability with existing OpenPGP applications.  I am not
aware of any new security problems with 3DES which would justify such
a step.  Adding AES-128 as another MUST algorithm would be fine with
me but this breaks interoperability too.

SHA-256 is even worser.  In addition to the interop problems,
applications using OpenPGP tools need to be changed to make use of the
longer digest.  Dropping MD5 is really a good idea, but I doubt that
SHA-256 has been analyzed as much as the older algorithms.  Given that
there are now doubts on the general design principle of all common
hash algorithms, I think it is a bit to early to make it a MUST.

I guess that there are other things in OpenPGP that are more
vulnerable to attacks than SHA-1.  Better do a new RFC now and then
start thinking about all the open issues.

Shalom-Salam,

   Werner

---

From: David Shaw <[email-masked]>
Date: Tue, 8 Feb 2005 13:58:32 -0500

> and MUST hash to SHA-256?

This would be difficult to do without breaking backwards
compatibility.  There are a lot of deployed systems that expect 3DES
to be the MUST cipher.

I'm not against adding a second MUST cipher without removing the
current 3DES, but I don't see how the 3DES as the
cipher-of-last-resort could be changed except over a significant
amount of time.

David

---

From: Edwin Woudt <[email-masked]>
Date: Tue, 08 Feb 2005 21:23:22 +0100

--On 8-2-2005 9:42 -0800 Jon Callas <[email-masked]> wrote:
> Triple-DES is pretty much obsolete. Yesterday, I saw that NIST announced
> they're moving to stronger hashes.
>
> Does anyone object to changing the MUST cipher to AES (I'd pick 128) and
> MUST hash to SHA-256?

Regarding SHA-256: would that mean switching to SHA-256 for key 
fingerprints as well? (shouldn't v5 keys be introduced then?) And use 
SHA-256 for MDC packets?

Or is it just adding a MUST implement, so applications can use SHA-256 for 
document signatures with RSA keys only? (as DSA forces one to use SHA-1 
anyway)

IMHO, the first is what should be done at some point, but that's a really 
big change: all implementations out there need to be upgraded. Wouldn't 
that conflict with getting the current draft on standards track?

I do not see the point of the second option: as long as keys are only 
protected by a 160 bit figerprint, there is not much point protecting 
document signatures with longer hashes. It may be harder to generate a 
collision resulting in a valid key, then it is to generate a collision 
resulting in just some other random document, but I do not think it is wise 
to count on such an assumption.

-- 
Edwin