Subject: Question about MDC Packets

From: Len Sassaman <[email-masked]>
Date: Mon, 22 Jul 2002 12:10:10 -0700 (PDT)

In RFC 2440-bis5:5.13, it says:

   There is a corresponding feature in the features signature subpacket
   that denotes that an implementation can properly use this packet
   type. An implementation SHOULD NOT use this packet when encrypting
   to a recipient that does not state it can use this packet, and
   SHOULD prefer this to older Symmetrically Encrypted Data Packet when
   possible.

This doesn't, however, give any indication of what to do when using pure
symmetric encryption. What is the preferred behavior when symmetrically
encrypting a file using AES? Should an OpenPGP implementation use the MDC
by default?

--Len.

---

From: Jon Callas <[email-masked]>
Date: Mon, 22 Jul 2002 12:49:00 -0700

> encrypting a file using AES? Should an OpenPGP implementation use the MDC

Do you know anything about who is going to be decrypting it? Do you have
some reasonable expectation they can understand it? If so, then yes.

There is nothing wrong with an implementation being somewhat weasely. If you
make the guess that if someone wants to use AES, then the target is modern
enough to understand an MDC, you'd probably be right. You could even
convincingly harumph if someone does *not* use an MDC but went to the
trouble to do AES.

Incidentally, it's important that people start using MDCs more.

    Jon

---

From: David Shaw <[email-masked]>
Date: Mon, 22 Jul 2002 16:41:46 -0400

> Incidentally, it's important that people start using MDCs more.

FWIW, GnuPG does what Jon describes here and generates a MDC for AES
and TWOFISH.

David

-- 
   David Shaw  |  [email-masked]  |  WWW http://www.jabberwocky.com/
+---------------------------------------------------------------------------+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson

Date: Mon, 22 Jul 2002 16:41:46 -0400
From: David Shaw <[email-masked]>
To: OpenPGP <[email-masked]>
Subject: Re: Question about MDC Packets
Mail-Followup-To: OpenPGP <[email-masked]>
Sender: [email-masked]

> Incidentally, it's important that people start using MDCs more.

FWIW, GnuPG does what Jon describes here and generates a MDC for AES
and TWOFISH.

David

-- 
   David Shaw  |  [email-masked]  |  WWW http://www.jabberwocky.com/
+---------------------------------------------------------------------------+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson

Date: Mon, 22 Jul 2002 12:49:00 -0700
Subject: Re: Question about MDC Packets
From: Jon Callas <[email-masked]>
To: Len Sassaman <[email-masked]>, OpenPGP <[email-masked]>
Sender: [email-masked]

    Jon

Date: Mon, 22 Jul 2002 12:10:10 -0700 (PDT)
From: Len Sassaman <[email-masked]>
To: <[email-masked]>
Subject: Question about MDC Packets
Sender: [email-masked]

--Len.

Date: Mon, 15 Jul 2002 11:07:32 -0700
Subject: Re: Is PGP Freeware v6.5.8 compatible with Windows XP? 
From: Jon Callas <[email-masked]>
To: g kare <[email-masked]>, OpenPGP <[email-masked]>
Sender: [email-masked]

On 7/15/02 10:13 AM, "g kare" <[email-masked]> wrote:

> Is PGP Freeware v6.5.8 compatible with Windows XP?
> 
> Thanks!

You should ask at <[email-masked]>. They handle user software.
This list is about the standard and protocol, not any of the actual products
like PGP or GPG.

    Jon

From: "g kare" <[email-masked]>
To: [email-masked]
Subject: Is PGP Freeware v6.5.8 compatible with Windows XP? 
Date: Mon, 15 Jul 2002 17:13:06 +0000
Sender: [email-masked]

Hello,

Is PGP Freeware v6.5.8 compatible with Windows XP?

Thanks!

Gary

_________________________________________________________________
MSN Photos is the easiest way to share and print your photos: 
http://photos.msn.com/support/worldwide.aspx

Date: Fri, 12 Jul 2002 13:26:11 +0300
From: Nikos Mavroyanopoulos <[email-masked]>
To: [email-masked], [email-masked]
Subject: draft-ietf-tls-openpgp-keys
Mail-Followup-To: [email-masked], [email-masked]
Sender: [email-masked]

 Currently we have two internet drafts that both describe a way to
use TLS with openpgp keys. The differences between them seem to be
artistic[0], and can be concluded to whether the extension mechanism
should be used, or new ciphersuites should be defined.

Now both of them have a working implementation, and this shows that
there is indeed interest in TLS with openpgp keys.

So I'd like to ask the TLS WG, if there are any objections against TLS with 
openpgp keys? Is there any interest to move any of these drafts to RFC
status?

If we decide that this functionality is needed and requested, we can proceed 
and choose which one to move. But I believe that this should be done later,
in a technical discussion.

Since the reason of not moving any of these drafts to RFC status was the 
lack of support, if you support any of these drafts, please express your 
support in the ietf-tls mailing list.

PS. the drafts can be found at:
http://www.ietf.org/internet-drafts/draft-ietf-tls-openpgp-02.txt
http://www.ietf.org/internet-drafts/draft-ietf-tls-openpgp-keys-01.txt

[0]. I have a strong objection against the keyID as used in the 
draft-ietf-tls-openpgp-02.txt, but this is rather technical and can
be discussed afterwards.

-- 
Nikos Mavroyanopoulos
mailto:[email-masked]

Date: Tue, 2 Jul 2002 09:56:31 -0400
From: David Shaw <[email-masked]>
To: [email-masked]
Subject: Re: How to handle photoID on keyserver?  (Re: photo support?)
Mail-Followup-To: [email-masked]
Sender: [email-masked]

On Tue, Jul 02, 2002 at 12:58:35AM -0400, Michael Young wrote:

> PGP doesn't use images anywhere near this size.  David Shaw
> suggested that GnuPG will accept any size image, but even so,
> I doubt that many people will attach such a large image
> to their key.  [I might suggest that GnuPG refuse large
> images by default, perhaps overridden with its "-expert" flag.]

GnuPG does something similar to this - any image over 6k is refused
unless the user confirms it.  (i.e. "This image is really large!  Are
you sure you want to use it?" and the default is "no")

David

-- 
   David Shaw  |  [email-masked]  |  WWW http://www.jabberwocky.com/
+---------------------------------------------------------------------------+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson

From: "Michael Young" <[email-masked]>
To: <[email-masked]>
Subject: Re: How to handle photoID on keyserver?  (Re: photo support?) 
Date: Tue, 2 Jul 2002 00:58:35 -0400
Sender: [email-masked]

Subject: Re: How to handle photoID on keyserver?  (Re: photo support?) 

PGP doesn't use images anywhere near this size.  David Shaw
suggested that GnuPG will accept any size image, but even so,
I doubt that many people will attach such a large image
to their key.  [I might suggest that GnuPG refuse large
images by default, perhaps overridden with its "-expert" flag.]

I'd also guess that a 3% usage rate is very high.  The vast
majority of the keys on the public servers don't have any
signatures (other than self-).

>   Someone who is not owner of that public key can put public key
>   with PhotoID into public keyserver.  And everyone can get someone's
>   public key with PhotoID.

Yes, anyone can post a key claiming any identity.  This is
really nothing new.

If you're worried about people attaching bogus identities to
established keys, your keyserver could reject those without
self-signatures.  (Most of the keyservers do no verification
at all right now, so this would be a significant change.)

And yes, you could reject photoID packets (and any associated
signatures) if you think size is a problem.  (Even if you
reject them, I would encourage you to leave them in your
sync stream to other keyservers, as they may have a more
permissive policy.)

> I mean if dump key size is 15GB, HDD size is required 60GB at least.

I'm curious as to why this would be.  I can understand some
blowup because of indexing structures, but since you aren't
indexing the photoID packets anyway, I wouldn't expect the
same factor you have now.

Date: Mon, 1 Jul 2002 23:51:58 -0400
From: David Shaw <[email-masked]>
To: [email-masked]
Subject: Re: How to handle photoID on keyserver?  (Re: photo support?)
Mail-Followup-To: [email-masked]
Sender: [email-masked]

On Tue, Jul 02, 2002 at 11:16:11AM +0900, Hironobu SUZUKI wrote:

> 2) Privacy issue:
> 
>   Someone who is not owner of that public key can put public key
>   with PhotoID into public keyserver.  And everyone can get someone's
>   public key with PhotoID.

Anyone can upload *any* public key to a keyserver or distribute it via
whatever means they like.  This is the same "risk" as someone
uploading a key with my email address on it.  If I do not want my
photograph (or email address, name, public key, etc.)  made public,
then... I should not make it public.

> I think that most OpenPGP users concern privacy issue.  Size issue
> become problem to some public keyserver sites.  From my experience,
> entire of storage size for handling public keysever may require 4
> times (or more) of whole of public keys. I mean if dump key size is
> 15GB, HDD size is required 60GB at least.
> 
> In my opinion, if public key with photoID is submitted public
> keyserver, public keyserver remove photoID and related signature
> packets and store the remains of packates into database.

Any keyserver operator is free to do this.  Conversely, any keyserver
operator is free to not do this.  Some keyservers have been storing
keys with photo IDs on them for years.  Some keyservers have been
removing photo IDs for years[1].

Where's the problem?

David

[1] Admittedly, pksd removes photo IDs because it doesn't understand
    them, and not due to a design choice, but the effect is the same.

-- 
   David Shaw  |  [email-masked]  |  WWW http://www.jabberwocky.com/
+---------------------------------------------------------------------------+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson

From: Hironobu SUZUKI <[email-masked]>
To: [email-masked]
Subject: How to handle photoID on keyserver?  (Re: photo support?) 
Date: Tue, 02 Jul 2002 11:16:11 +0900
Sender: [email-masked]

Hi, 

I have some questions about PhotoID  in public keyserver. 

  Note: public keyserver means "key server which is open to the
        public". 

  See also:
         http://galileo.spaceports.com/~jharris/keyserver.html

1) Size issue: 

  If 3% public keys have 1280 x 960 jpeg photo, Public keyserver will
  require storage area more than 13.7GB (at least).

   a) 1280 x 960 jpeg is used the default size of many digital camera.
   b) ((300 * 2^10) * (1.6 * 10^6 * 0.03)) / (2^30) = 13.732
   c) 1.6Mkeys have been submitted into current public keyserver
      and key dump size is almost 2GB.
   
2) Privacy issue:

  Someone who is not owner of that public key can put public key
  with PhotoID into public keyserver.  And everyone can get someone's
  public key with PhotoID.

I think that most OpenPGP users concern privacy issue.  Size issue
become problem to some public keyserver sites.  From my experience,
entire of storage size for handling public keysever may require 4
times (or more) of whole of public keys. I mean if dump key size is
15GB, HDD size is required 60GB at least.

In my opinion, if public key with photoID is submitted public
keyserver, public keyserver remove photoID and related signature
packets and store the remains of packates into database.

Regards,

-- 
Hironobu SUZUKI
E-Mail: [email-masked]
URL: http://h2np.net

From: "Michael Young" <[email-masked]>
To: <[email-masked]>
Subject: Re: photo support?
Date: Mon, 1 Jul 2002 17:55:04 -0400
Sender: [email-masked]

Subject: Re: photo support?

From: "vedaal" <[email-masked]>
> this can lead to an overburdening of servers with 'bloated' keys, with
> whatever someone may decide to want to 'store'.

This is hardly unique to the "photo ID" field.  It would be easy to "store"
arbitary content in:
    a notation subpacket in a valid signature;
    signature MPIs;
    user names; or, even
    public key MPIs.

It is impossible to prevent this sort of abuse without seriously impairing
legitimate use of the public keyservers.

One man's garbage is another man's key.

> it might be worthwhile to consider some maximal size for a recommended
> standard, which can be implemented by the servers
> refusing to accept a key greater than a certain size.

A size recommendation seems reasonable, as an implementation guideline.
A strict limit in the protocol seems most unreasonable.

This kind of restriction alone won't prevent abuse.  It's only the tip
of the iceberg.

Key servers owners can always implement any restrictive policy they
want.  I would urge them not to hack at specific small holes unless
there is an actual problem.  If a bug in a widely used implementation
were to start generating this sort of junk, then I might act.  But
that hasn't been a serious problem yet.

Date: Mon, 1 Jul 2002 17:55:26 -0400
From: David Shaw <[email-masked]>
To: [email-masked]
Subject: Re: photo support?
Mail-Followup-To: [email-masked]
Sender: [email-masked]

On Mon, Jul 01, 2002 at 03:49:24PM -0400, vedaal wrote:

> > Is there a standardized way to embed photos in OpenPGP keys?  Anyone
> > interested in writing such a standard?
> 
> as it is now, it is definitely 'different' for PGP and GnuPG.
> 
> PGP compresses the .jpg into the photo id, and does not export it when
> exporting the key.
> 
> GnuPG leaves the .jpg intact as added by the user, and exports it intact as
> part of the .asc
> 
> if PGP downloads a public key with a photo id, that was generated by GnuPG,
> it will export a photo as part of the .asc, but 'altered/compressed'.
> the exported .asc of the public key will be different than the exported .asc
> of the GnuPG key.

Altered or compressed in what way?  If PGP changes the photo, then it
would break all signatures on the photo ID.

PGP does alter the photo when you paste it in (converts it to jpeg and
shrinks it), but once it's in the key, it does not change it.  GnuPG
requires a jpeg from the user and does not change it.  Either of these
is fine, since the spec says nothing about what happens to the photo
before it is placed into the key.

It does not matter if the ascii-armored representation of the key is
different between GnuPG and PGP.  This does not necessarily mean that
the photo has been changed.

David

-- 
   David Shaw  |  [email-masked]  |  WWW http://www.jabberwocky.com/
+---------------------------------------------------------------------------+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson

Date: Mon, 1 Jul 2002 13:57:28 -0700
From: "Hal Finney" <[email-masked]>
To: [email-masked], [email-masked]
Subject: Re: photo support?
Sender: [email-masked]

Vedaal writes:
> if PGP downloads a public key with a photo id, that was generated by GnuPG,
> it will export a photo as part of the .asc, but 'altered/compressed'.
> the exported .asc of the public key will be different than the exported .asc
> of the GnuPG key.

I don't think it re-compresses the JPEG, I'm not aware of any code that
would do that.  However it is possible that there is some incompatibility
between GPG and PGP in the handling of photo IDs.  Can you provide me
with a GPG-created key with a photo ID, and I will see what happens to
it with PGP.

Hal Finney

Date: Mon, 1 Jul 2002 17:06:53 -0400
From: David Shaw <[email-masked]>
To: [email-masked]
Subject: Re: photo support?
Mail-Followup-To: [email-masked]
Sender: [email-masked]

On Mon, Jul 01, 2002 at 09:11:05PM +0200, Simon Josefsson wrote:
> 
> Is there a standardized way to embed photos in OpenPGP keys?

Yes.  I documented the existing PGP method for the latest 2440bis
draft.  Both PGP and GnuPG use this method.

It is actually a very general "embed anything" system.  Photos are
just the only currently defined attribute to be embedded.

David

-- 
   David Shaw  |  [email-masked]  |  WWW http://www.jabberwocky.com/
+---------------------------------------------------------------------------+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson

From: "vedaal" <[email-masked]>
To: <[email-masked]>
Subject: Re: photo support?
Date: Mon, 1 Jul 2002 15:49:24 -0400
Sender: [email-masked]

----- Original Message -----
From: "Simon Josefsson" <[email-masked]>
To: <[email-masked]>
Sent: Monday, July 01, 2002 3:11 PM
Subject: photo support?

> Is there a standardized way to embed photos in OpenPGP keys?  Anyone
> interested in writing such a standard?

as it is now, it is definitely 'different' for PGP and GnuPG.

PGP compresses the .jpg into the photo id, and does not export it when
exporting the key.

GnuPG leaves the .jpg intact as added by the user, and exports it intact as
part of the .asc

if PGP downloads a public key with a photo id, that was generated by GnuPG,
it will export a photo as part of the .asc, but 'altered/compressed'.
the exported .asc of the public key will be different than the exported .asc
of the GnuPG key.

as a side-issue,
since the .jpg of a GnuPG generated photo-id is left intact,
it is possible to steganographically embed data within the key id photo
which can be retrieved intact from anywhere by downloading the key from an
ldap server.

it is possible to store a conventionally encrypted pgp file containing a
revocation certificate and passphrase for the key, and still have the .jpg
size at 4k,

but it is also possible to store the private key too, but with a .jpg
carrier size of 20 k.

this can lead to an overburdening of servers with 'bloated' keys, with
whatever someone may decide to want to 'store'.

it might be worthwhile to consider some maximal size for a recommended
standard, which can be implemented by the servers
refusing to accept a key greater than a certain size.

a reasonable size would be the size of existing typical keys with photo
id's, with a .jpg size of 4k.
{for illustration purposes, PRZ's photo size is 3.7k}

vedaal

To: [email-masked]
Subject: photo support?
From: Simon Josefsson <[email-masked]>
Date: Mon, 01 Jul 2002 21:11:05 +0200
Lines: 2
Sender: [email-masked]

Is there a standardized way to embed photos in OpenPGP keys?  Anyone
interested in writing such a standard?