Subject: Face to face meeting in Cozumel?

From: [email-masked] (Daniel A. Nagy)
Date: Thu, 17 Jan 2008 15:05:50 +0100

Dear WG,

I have noticed, that several active members of the WG are going to attend
FC2008 in Cozumel, Mexico.

Would you be interested in an informal meeting to discuss some
OpenPGP-related issues face to face? A restaurant or a lounge in the hotel
would be my preferred location.

As for myself, I would like to discuss the following (in this order of
importance):

- C library development. Currently, we have an orphaned(?) OpenCDK and an
  incomplete OpenPGP:SDK. A native C library would open the door for
  efficient, usable libraries for other languages (Perl, Python, Ruby,
  PHP, etc.), so I feel that this is very important. I am counting on Ben
  Laurie's participation for this one.

- Reference implementations, test vectors.

- Exotic signature types and their possible uses, semantics (timestamp,
  notarization, standalone, etc.).

- Forward secrecy

Perhaps, others might have other topics that could benefit from face-to-face
discussion.

Cheers,

-- 
Daniel

---

From: Ben Laurie <[email-masked]>
Date: Thu, 17 Jan 2008 16:09:57 +0000

>   Laurie's participation for this one.

Unfortunately I had to cancel Cozumel because of other commitments.

I do welcome the attention to OpenPGP:SDK, which is gradually getting
more complete. I'd be happy to find some other opportunity to meet - for
example, I am frequently in the Bay Area (next week, for example). Also,
I will be at NDSS and ShmooCon.

> - Reference implementations, test vectors.

+1

>   notarization, standalone, etc.).

My name is on this one, too :-)

-- 
http://www.apache-ssl.org/ben.html           http://www.links.org/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 17 Jan 2008 17:33:43 +0100

> - C library development. Currently, we have an orphaned(?) OpenCDK and an

I'm not going to be in Cozumel.  In response to the '(?)', OpenCDK has
recently been updated (the 0.6.x series) after a long period of minimal
maintainance.  We are moving towards a LGPL version of libopencdk, which
was included in the core GnuTLS library git repository just a few days
ago.

/Simon

---

From: "Arturo 'Buanzo' Busleiman" <[email-masked]>
Date: Thu, 17 Jan 2008 14:47:59 -0200

I'd love to attend, specially now that the my OpenPGP Session Management for HTTP (Firefox/Apache)
is complete, but sorry :(

- --
Arturo "Buanzo" Busleiman
The Charlie Protas Project is on its way
Independent Security Consultant - SANS - OISSG
http://www.buanzo.com.ar/pro/

---

From: Derek Atkins <[email-masked]>
Date: Thu, 17 Jan 2008 12:39:35 -0500

> is complete, but sorry :(

I'm afraid I wont be in Cozumel, either.

-derek
-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Ian G <[email-masked]>
Date: Thu, 17 Jan 2008 18:50:32 +0100

Arturo 'Buanzo' Busleiman wrote:

> ... the my OpenPGP Session Management 
> for HTTP (Firefox/Apache)

Que es?

iang

---

From: [email-masked] (Daniel A. Nagy)
Date: Thu, 17 Jan 2008 21:59:03 +0100

> was included in the core GnuTLS library git repository just a few days

Good to know! Thank you for the update. Do you have a homepage? How about
API documentation?

I have been using OpenCDK for several projects at ePoint System, but seeing
it abandoned, I considered switching to OpenPGP:SDK, which, unfortunately,
is not up to the task yet.

I strongly believe that having a widely used C library for common OpenPGP
functionality would be great for the wider acceptance and use of the standard.
It is very good to hear that OpenCDK is supported again!

Cheers,

-- 
Daniel

---

From: Jon Callas <[email-masked]>
Date: Fri, 18 Jan 2008 14:35:35 -0800

> would be my preferred location.

It might be just you and me, but sure!

	Jon

---

From: Simon Josefsson <[email-masked]>
Date: Sat, 19 Jan 2008 12:13:10 +0100

> Good to know! Thank you for the update. Do you have a homepage? How about

None exist online as far as I know, but Timo would know for sure.  The
code is documented, so it is easy to generate API documentation.  I
placed the latest generated HTML online at:

http://josefsson.org/gnutls/manual/opencdk/opencdk-api.html

Generating it using Doxygen or GTK-DOC instead, to yield nicer
formatting etc, shouldn't be too hard.

> is not up to the task yet.

GnuTLS uses OpenCDK and Nikos has been quite active in working on it
recently, to make it implement the latest OpenPGP-in-TLS RFC.

> It is very good to hear that OpenCDK is supported again!

Right.

/Simon

---

From: "Rachel Willmer" <[email-masked]>
Date: Mon, 21 Jan 2008 12:50:11 +0000

On 17/01/2008, Daniel A. Nagy <[email-masked]> wrote:
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.6 (GNU/Linux)
>
> iQDVAwUBR49gva6pEulQFnIMAQJb1QX/RayunUWsw+TKH8ouiea4nKz7Emi/JIEn
> DvkLncKNoUY8KoNEdVQcIniT9WGr7Ll5qL228nPKFa6SFS9R5gQXt6xbBb6oBNGs
> WxOw+ACsXXncnjY8P0thDE1MW6ckUtCW7wjAe2EvsLyUlu/5f68sbnjacfYk1Vv0
> oWs+JLSldfToJXgad36gIgJ+u0I+rru/IDocJfKukHiBhnhSwBw73NdseS4KiS6y
> vc68tos/1Vc7GCmJKocLiCucAvAZ/A1f
> =hfuA
> -----END PGP SIGNATURE-----
>
>

---

From: "Rachel Willmer" <[email-masked]>
Date: Mon, 21 Jan 2008 13:00:22 +0000

>   Laurie's participation for this one.

Current plan for OpenPGP:SDK is to have a release out in the summer.
It won't be complete (RSA only for one thing) but it will do what it
does well, with a good test suite and documentation. That's the plan,
anyway!

Currently working and interoperating with GPG:
- encryption
- decryption
- signature verification
- cleartext signature generation and verification

In progress:
- signature generation

To Do:
- Keyring management
- Command line app

Rachel

---

From: "Rachel Willmer" <[email-masked]>
Date: Mon, 21 Jan 2008 13:03:14 +0000

Sorry about the email with no useful content - must have hit the send
key by mistake!
Rachel

---

From: "Arturo 'Buanzo' Busleiman" <[email-masked]>
Date: Mon, 21 Jan 2008 11:16:55 -0200

> Current plan for OpenPGP:SDK is to have a release out in the summer.

Great! I really am looking forward to a library. I'm currently using
GPGME for my Apache's mod_openpgp module.

---

From: [email-masked] (Daniel A. Nagy)
Date: Mon, 21 Jan 2008 14:24:37 +0100

> GPGME for my Apache's mod_openpgp module.

Actually, OpenCDK (on top of gcrypt) is quite useful; I have an apache
module myself that is using that (mod_payment for pay-per-view stuff).

Now that the GnuTLS folks decided to maintain OpenCDK again, it might be a
viable alternative to OpenPGP:SDK. The nice thing about the latter is that
it uses openssl for crypto, which is installed everywhere anyway. So I am
still very much looking forward to its release.

-- 
Daniel

---

From: [email-masked] (Daniel A. Nagy)
Date: Mon, 21 Jan 2008 14:30:50 +0100

Thank you for the update, Rachel!

> does well, with a good test suite and documentation. That's the plan,

Doesn't the underlying crypto library (openssl, right?) provide you with all
the asymmetric algorithms? Why restrict the release to RSA?

> - cleartext signature generation and verification

Nice!

> - signature generation

Does this include certification?

> - Keyring management

But that's in the high-level API, isn't it?

> - Command line app

Is it going to be like pgp/gpg or more ssleay/openssl-eque?

Cheers!

-- 
Daniel

---

From: "Arturo 'Buanzo' Busleiman" <[email-masked]>
Date: Mon, 21 Jan 2008 11:35:21 -0200

> module myself that is using that (mod_payment for pay-per-view stuff).

That's quite interesting.

You read my mind about OpenSSL ;)

---

From: Simon Josefsson <[email-masked]>
Date: Mon, 21 Jan 2008 14:45:55 +0100

> module myself that is using that (mod_payment for pay-per-view stuff).

There is also mod_gnutls, which I think supports OpenPGP in TLS in
development versions (Nikos would know for certain).  Mod_gnutls uses
gnutls and opencdk.

http://www.outoforder.cc/projects/apache/mod_gnutls/

/Simon

---

From: "Rachel Willmer" <[email-masked]>
Date: Mon, 21 Jan 2008 14:02:35 +0000

---------- Forwarded message ----------
From: Rachel Willmer <[email-masked]>
Date: 21 Jan 2008 14:01
Subject: Re: Face to face meeting in Cozumel?
To: "Daniel A. Nagy" <[email-masked]>

> the asymmetric algorithms? Why restrict the release to RSA?

To keep the customer who's sponsoring the project happy. Everything
takes time to code, document and test; and they'd prefer to see a
minimal release now rather than a complete release later.

Once the initial release is done, then it should be easy to follow up
with support for other algorithms because of the use of openssl.

> Does this include certification?

Can you be more specific?

> But that's in the high-level API, isn't it?

There's some code to do with keyring management, but not everything.

> Is it going to be like pgp/gpg or more ssleay/openssl-eque?

How do you mean?

Rachel

---

From: Len Sassaman <[email-masked]>
Date: Tue, 22 Jan 2008 12:37:28 -0800 (PST)

> minimal release now rather than a complete release later.

There's also good reason not to support DSA in OpenPGP, due to the lack of
a hash function firewall. </deadhorse>