Subject: [openpgp] Regulation of algo deprecation

From: Nils Durner <[email-masked]>
Date: Tue, 3 Nov 2015 23:14:14 +0100

Hi,

I would like to elaborate on why I feel that algorithm deprecation
should also be guided by regulations. For Germany, the algorithm catalog
for Electronic Signatures[0] issued by the Federal Network Agency,
dictates that
> SHA-1 and RIPEMD-160, respectively, are suitable only for verification
> of qualified certificates until the end of 2015.

I feel that implementations should help users use crypto correctly - and
incorrect use also includes use of methods deemed insufficient by law,
IMO. IANAL, but repudiability based on algorithm choice should be
prevented against. Concrete example: a particular mail sent by Alice is
not considered legally binding because Bob failed to realize that the
algorithms used by Alice had already expired by regulation at the time
she sent the mail. In order not to burden implementers with such
considerations, I feel we should reflects this in the RFC already -
perhaps as RECOMMENDATIONs so that implementations may still provide a
--force parameter for anyone who exactly knows what they are doing or
just don't follow the legal canon (if there is one, I think this would
need some further research).

Responding to Werner's concern that, following this line of thought,
only Brainpool curves could be used: I don't see why. The 2014 version
of aforementioned catalog[0], as well as the 2015 draft (dated
28.10.2014), merely recommend Brainpool, but don't require it. For the
US, NIST naturally recommends NIST curves[2], but I don't see a
restriction to just P-384 there either. At any rate, I would just make
it RECOMMENDATIONs, not MUSTs - except for cases like MD5 where there is
general consensus for other, actually technical, reasons.

What do others think?

Regards,

Nils

[0]
https://www.bundesnetzagentur.de/SharedDocs/Downloads/DE/Sachgebiete/QES/Veroeffentlichungen/Algorithmen/2014Algorithmenkatalog.pdf
[1] https://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml

---

From: Aaron Zauner <[email-masked]>
Date: Wed, 04 Nov 2015 01:00:10 +0100

Hi,

Sorry due to time constraints I wasn't able to remotely participate in
the OpenPGP session. I've read the minutes, not sure if I got everything
from that though.

So my impression is that GnuPG / OpenPGP current support far to many
possible algorithm choices. We should really limit that. For novice
users it's not easy to get this right and there're only a few places on
the internet that provide a solid default config (e.g. riseup - though
I've modified their settings for personal use). The real problem with
PGP is that not a lot of people use it and adding tons of curves or
algorithms doesn't seem the right way to go. Maybe this has already been
discussed previously and I didn't notice - if so, I'd be happy for a
pointer to the relevant thread.

CFRG recently recommended Curve25519 (or whatever nomenclature is
currently en vouge), so why bother with Brainpool at all?

Aaron

---

From: Werner Koch <[email-masked]>
Date: Wed, 04 Nov 2015 09:15:37 +0100

> 28.10.2014), merely recommend Brainpool, but don't require it. For the

That is just one catalog but there are others.  For the German VS-NfD
(restricted level) other rules apply.  And the Russians have a different
catalog, as do the Japanese, and the Koreans, ...

Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.

---

From: Werner Koch <[email-masked]>
Date: Wed, 04 Nov 2015 09:25:14 +0100

> possible algorithm choices. We should really limit that. For novice

Right.  FWIW, I had a meeting in 2000 with PRZ and Jon Callas at the AES
conference in Rome where Phil begged us to limit the number of supported
algorithms.  Nevertheless we added Twofish (which was a high ranked AES
candidate then) anyway due to the need for 128 bit block cipher and
later we added Camellia for political reasons.

> currently en vouge), so why bother with Brainpool at all?

I took Brainpool merely as an example.  These curves are not defined by
an RFC but implementations may add them using an OID. Well, this OID
thing is somewhat questionable but then we also do not specify an upper
limit for RSA key sizes or require the support for certain key sizes.

Shalom-Salam,

   Werner

---

From: "Stan Borinski" <[email-masked]>
Date: Wed, 4 Nov 2015 05:51:37 -0500

On Wednesday, November 4, 2015 at 3:16 AM, Werner Koch wrote:
> To: Nils Durner <[email-masked]>
> Cc: [email-masked]
> Subject: Re: [openpgp] Regulation of algo deprecation
> 
(restricted
> level) other rules apply.  And the Russians have a different catalog, as
do the
> Japanese, and the Koreans, ...

This was my general thought when I read Nils' e-mail advocating using
regulation as guidance for deprecation.  I'm surprised he wasn't flooded
with responses.  I don't like this for two main reasons:

1. As Werner alludes to, we'd have to research the regulations of many
different countries.  And which countries are we talking about?... do we
have to come to agreement that we follow the guidelines/catalogs of only a
subset of countries?  This all seems very problematic.

2. If we're just going to rubber-stamp what Germany's Bundesnetzagentur,
USA's NSA/NIST, and others are recommending, then what's the point of *us*
going through the exercise of figuring out which algorithms that we
recommend or require to be deprecated?

Perhaps I'm taking Nil's use of the word "guidance" too strongly.  My view
is that our value as an IETF workgroup comes from an objective view of the
current state, where we judge the security of cryptographic algorithms based
on their technical and operational merits, unbiased by the view of any
governments or their standards bodies.

Regards,
Stan Borinski

---

From: ianG <[email-masked]>
Date: Fri, 6 Nov 2015 02:09:38 +0000

On 3/11/2015 22:14 pm, Nils Durner wrote:
> prevented against.

I think this is an over-reading of the dig-sig laws.  Although I haven't 
followed it for a couple of years, there have been court cases in 
Germany that have accepted digital signatures from non-qualified 
sources.  Also, the qualified signature programme in Europe is basically 
a failure.

I would recommend completely ignoring what some law says, and doing it 
right by the user.  You'll get into more trouble in trying to align with 
the law than by doing the right thing, in my not so humble opinion.

iang