Subject: Re: [openpgp] details of 4880bis work

From: Peter Gutmann <[email-masked]>
Date: Thu, 16 Apr 2015 08:19:02 +0000

Jon Callas <[email-masked]> writes:

>> e) update S2K with something more modern (PBKDF2, HKDF, scrypt?),
>>   deprecate all the other mechnanisms explicitly
>
>Agree completely on just using PBKDF2.
>
>You could put other more modern password grinders in, or even leave it open
>for new technologies to be introduced easily.

With any luck the PHC will be done by the time any new PGP RFC is published,
so there'd be a well-designed, attack-resistant password-processing function
ready to use.

Peter.