Subject: Re: I-D ACTION:draft-ietf-openpgp-camellia-00.txt

From: "David Crick" <[email-masked]>
Date: Tue, 27 Nov 2007 12:59:33 +0000

The reason only 256-bit keys were proposed was due to
Hironobu SUZUKI's initial request:

http://www.imc.org/ietf-openpgp/mail-archive/msg15591.html

key-length discussions happened here:

http://www.imc.org/ietf-openpgp/mail-archive/msg15674.html
http://www.imc.org/ietf-openpgp/mail-archive/msg15677.html
http://www.imc.org/ietf-openpgp/mail-archive/msg15678.html
http://www.imc.org/ietf-openpgp/mail-archive/msg15679.html

the final message likened the situation with only 256-bit key
Twofish.

HOWEVER, in addition to Daniel's technical comment in:

http://www.imc.org/ietf-openpgp/mail-archive/msg20265.html

I personally wonder if we also should take this opportunity
to add a 128-bit key+length alternative to AES in OpenPGP,
just because there currently isn't one.

One could argue about adding 128-bit Twofish as well/instead,
as it's been around longer and also went through the deep AES
process scrutiny.  However, on Camellia's side, it is a post-AES
cipher, and so benefits from more recent insights / design
trade-offs, PLUS it has gone through the scrutiny of both
NESSIE and CRYPTREC.  In addition it's already implemented
(in both 128-bit and 256-bit lengths) in applications (e.g. the
Linux kernel and Firefox 3.0 [beta]).

One outstanding question I see: have we ever had a reply back
from NTT giving an IPR statement SPECIFICALLY for OpenPGP, as
requested by Hironobu SUZUKI here?

http://www.imc.org/ietf-openpgp/mail-archive/msg15676.html

This was intended to clarify the general statement given here:

http://www.imc.org/ietf-openpgp/mail-archive/msg15607.html

---

From: Hironobu SUZUKI <[email-masked]>
Date: Wed, 28 Nov 2007 00:33:33 +0900

> Linux kernel and Firefox 3.0 [beta]).

I have no objection against your opinion that about Camellia.  It is
well designed cipher.  I mentioned that most important thing is that we
need 256-bit for some security reason for OpenPGP.

 http://www.imc.org/ietf-openpgp/mail-archive/msg20263.html

> requested by Hironobu SUZUKI here?

Yes.  I already have discussed about it with a NTT person who is a team
leader of Camellia project. They will give an IPR for OpenPGP.

Regards,

---
Hironobu SUZUKI <hironobu at h2np dot net>
Tokyo, Japan.
http://h2np.net

---

From: Hironobu SUZUKI <[email-masked]>
Date: Wed, 28 Nov 2007 15:01:48 +0900

> leader of Camellia project. They will give an IPR for OpenPGP.

When I sent my email to him yesterday, he replied very quickly. "It was
done at 6 month ago". And NTT Licensing Group did their job very
quickly. OMG ;-)

IPR is as below: 

  https://datatracker.ietf.org/ipr/861/

  Submitted Date: July 4, 2007 

  I. Patent Holder/Applicant ("Patent Holder")
  Legal Name: 	Nippon Telegraph and Telephone Company and Mitsubishi Electric Corporation

  II. Patent Holder's Contact for License Application
  Name: 	Isamu Yoshimatsu
  Title: 	Senior Manager, Licensing Group
  Department: 	Intellectual Property Center
  Address1: 	Nippon Telegraph and Telephone Corporation

  III. IETF Document or Other Contribution to Which this IPR Disclosure Relates:
  Designations for Other Contributions:	Camellia

It's OK?

Regards,

---

---

From: Jon Callas <[email-masked]>
Date: Wed, 28 Nov 2007 00:24:58 -0800

> done at 6 month ago". And NTT Licensing Group did their job very

Well, thank them very much for us!

As for 128-bit keys, it sounds like we have a rough consensus that it  
is not crazy to have them. How about if we discuss them seriously?

Who is actually going to *use* (or implement) Camillia? PGP  
Corporation would implement it, and I personally would not object to  
having it in my key's cipher preferences. I wouldn't put it at the  
top, but I wouldn't object to having it u there with AES and Twofish.

	Jon

---

From: Werner Koch <[email-masked]>
Date: Wed, 28 Nov 2007 11:38:11 +0100

> Who is actually going to *use* (or implement) Camillia? PGP  

GnuPG has already implemented Camillia-256 for testing.  We are justing
waiting for IDs to enable it.  I'd also like to add Camillia-128 for gpg
(we support all Camillia key lengths in GnuPG's S/MIME tool gpgsm).

Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Auschnahme regelt ein Bundeschgesetz.

---

From: Derek Atkins <[email-masked]>
Date: Wed, 28 Nov 2007 10:57:04 -0500

> Well, thank them very much for us!

I'll take a look at the IPR disclosure and see how it affects us.
Thank you.

> is not crazy to have them. How about if we discuss them seriously?

To me it certainly sounds like there are more people who say
they'd like 128-bit or "don't care" than those who say that they
definitely do NOT want 128-bit.  So I think there's rough consensus
to have 128- and 256-bit Camellia keys.

> top, but I wouldn't object to having it u there with AES and Twofish.

-derek

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Ian G <[email-masked]>
Date: Thu, 29 Nov 2007 17:39:02 +0100

> to have 128- and 256-bit Camellia keys.

To clarify the discussion on 128-bit Camelia cipher, there 
is rough consensus to have it, or at least my arguments 
shouldn't be seen as any vote against a rough consensus.

iang