Subject: Re: Question about MDC Packets

From: Len Sassaman <[email-masked]>
Date: Wed, 21 Aug 2002 22:43:19 -0700 (PDT)

On Mon, 22 Jul 2002, Jon Callas wrote:

> Do you know anything about who is going to be decrypting it? Do you have
> some reasonable expectation they can understand it? If so, then yes.
>
> There is nothing wrong with an implementation being somewhat weasely. If you
> make the guess that if someone wants to use AES, then the target is modern
> enough to understand an MDC, you'd probably be right. You could even
> convincingly harumph if someone does *not* use an MDC but went to the
> trouble to do AES.

Okay, hear me harumph.

We're in the process of adding AES and MDC support to Mixmaster. I need to
decide whether to we want to go the "be liberal... but conservative" route
and only use MDC if specified in the features subpacket, or the more
secure route, and use MDC whenever a key lists prefs 7 through 10
(presumably, we could do this even if we weren't actually choosing those
ciphers for encryption, i.e. if CAST5 was listed first). I'd prefer to do
it in the latter fashion, but...

I just read over the source code for Hushmail's OpenPGP features. It
appears that they were working off of RFC2440-bis2, and therefore didn't
know anything about the MDC packets. Hushmail keys are generated with
symmetric cipher prefs "9 8 7 3".  Consequently, Hushmail users cannot
decrypt messages encrypted with AES using the MDC packet. An example key
is attached at the bottom of this email.

It would be unfortunate to have more compatibility problems between
implementations of OpenPGP. Would it be unreasonable to state in the spec
that implementations supporting ciphers other than 0 through 4 SHOULD be
able to handle the MDC packets (perhaps in the paragraph in 5.13 which
mentions AES and Twofish currently)?

This would place the burden of maintaining compatibility on the side of
the less secure implementation.

--Len.

---

From: David Shaw <[email-masked]>
Date: Thu, 22 Aug 2002 13:32:14 -0400

> mentions AES and Twofish currently)?

Seems to me that the draft already states that *all* implementations
SHOULD be able to handle MDC packets, regardless of cipher ("An
implementation SHOULD prefer this to the older Symmetrically Encrypted
Data Packet when possible.").

The question is really what to do to determine when it is
"possible". ;)

David

-- 
   David Shaw  |  [email-masked]  |  WWW http://www.jabberwocky.com/
+---------------------------------------------------------------------------+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson

---

From: Adam Back <[email-masked]>
Date: Thu, 22 Aug 2002 19:23:13 +0100

Wasn't this discussed at some point in the past and the suggestion
made that all 128 bit block ciphers use MDC as they were introduced at
roughly the same time.

That leaves the hushmail problem.  But due to their software
architecture presumably forced software upgrades are easy.  (Just
publish new java code, the fact that the cached code is more recent on
the server takes care of the rest.)  Any other implementations
ignoring this rule?

I'm guessing this discussed rule never made it into the spec.  (We
have a general issue with over laxness on compatibility issues -- as
long as it's possible in theory to interoperate, the concencus in the
past has seemed to be to stop there.)

All implementations MUST use MDC with > 64 bit block cipher algorithms
(such as AES).

Adam