Subject: Re: [openpgp] "OpenPGP Simple"

From: Peter Gutmann <[email-masked]>
Date: Mon, 16 Mar 2015 01:51:19 +0000

Stephen Paul Weber <[email-masked]> writes:

>Is there any prior art on IETF specs having a "full" and "simple" form where
>full implementations can read any output of simple ones, but not always vice-
>versa?  

Yes and no.  I've tried this with the great pile of spaghetti that is the SSH
protocol (see https://www.cs.auckland.ac.nz/~pgut001/pubs/simplessh.txt), but
SSH has the same problem as PGP does, there's a single dominant implementation
that defines what the protocol is, and everyone else codes to that rather than
the spec (for SSH it's somewhat worse in that the client-side implementation
is Putty, which has bug-workarounds for all manner of broken implementations,
as a result of which it'll accept any old rubbish while at the same time being
used as a validation suite by developers of further broken implementations).

So even if you define a simple-PGP profile, I'm not sure how much (if any)
traction it'll get.

Peter.

---

From: Peter Gutmann <[email-masked]>
Date: Tue, 17 Mar 2015 08:17:35 +0000

Jon Callas <[email-masked]> writes:

>But when you do, take into account that MDC pre-dates HMAC 

"Implementation of Chosen-Ciphertext Attacks against PGP and GnuPG" was
published at ISC'02, the MDC mechanism appeared in OpenPGP drafts around
2000-2001.  "Keying Hash Functions for Message Authentication" dates from
1996, predating even the original OpenPGP spec (RFC 2440 from 1998, which
doesn't mention MDC).

>Standards are compromises, and a good compromise leaves everyone a bit
>grumpy. Since those days, I’ve developed an affection for MDC because it sits
>in a nether world where related concepts like deniable encryption that also
>sound good until you think about them for long enough.

See "The Order of Encryption and Authentication for Protecting Communications
(Or: How Secure is SSL?)?" from Crypto'01.

Peter.