Subject: V3 secret keys

From: Ben Laurie <[email-masked]>
Date: Mon, 06 Feb 2006 17:59:48 +0000

OK, I had to resort to reading the PGP 2 source to find out what was
going on here.

In essence its fairly simple, but is _definitely_ no explained by the I-D.

Firstly, v3 CFB does not use the IV in a standard way. Instead, what it
does instead is set the IV to all zeroes and then decrypt the IV and
throw away the result.

Secondly, as I think was correctly explained by someone here (but I
didn't get it, sorry), when "resynchronisation" occurs it means "set the
IV to the last 8 bytes of ciphertext".

Note that for any standard-sized key resynchronisation does _not_ occur,
so people who think they've implemented it from AC are in for a surprise
one day.

Obviously the I-D should be updated to reflect this (and clearly no-one
has ever implemented v3 keys from it).

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

From: Ian G <[email-masked]>
Date: Tue, 07 Feb 2006 12:23:29 +0100

> In essence its fairly simple, but is _definitely_ no explained by the I-D.

I would agree.  The fantastic PGP chaining mode
is my number one favourite feature to get the axe
just as soon as possible.

Your story has been repeated many times...  I
recall massive arguments about it when we implemented
it in Java originally; for less than 10 lines of code
it generated days of anger as various people argued
this point or that point.

> has ever implemented v3 keys from it).

(I'm not qualified to rewrite the draft on that issue.)

iang

---

From: [email-masked] (Peter Gutmann)
Date: Wed, 08 Feb 2006 11:50:59 +1300

>(I'm not qualified to rewrite the draft on that issue.)

Why not just include the pseudocode (or more usefully straight C code) for
the operation?  That's the ultimate definitive description, any programmer
can understand it, and you don't run into the problems you do with the
english description.

(Even if an implementer doesn't understand it, they can always just cut &
paste the code).

Peter.

---

From: Ian G <[email-masked]>
Date: Wed, 08 Feb 2006 11:15:58 +0100

> (Even if an implementer doesn't understand it, they can always just cut &

That I agree with.  It's how it's done, anyway,
as evidenced from the several references to "and
I went back into the old code..."

iang

---

From: Ben Laurie <[email-masked]>
Date: Wed, 15 Feb 2006 05:19:11 +0000

> (Even if an implementer doesn't understand it, they can always just cut &

Isn't there some dumb IETF rule against that?