Subject: Re: Czech attack to PGP

From: [email-masked]
Date: Thu, 22 Mar 2001 15:52:06 -0800

Florian Weimer, <[email-masked]>, writes:
> Hmm.  What about introducing a new secret key packet with a hash
> instead of a checksum? This approach seems to be much cleaner, and it
> doesn't cause surprising problems for the end user.

I think that is basically what I was suggesting, except using an HMAC
(which is a keyed hash).  This would be a new format for secret key
packets.  Then we'd have to work out the details in terms of what we do
with version numbers and such.

Then there is the issue that if we are changing the packet format, maybe
we should make other changes as well.  Then, if we're changing the secret
key packet format, should the public key packet be changed as well,
which introduces interoperability and backwards-compatiblity problems.
It kind of opens a can of worms if we go this way.  On the other hand,
given that any new key format won't be backwards-compatible, if there are
other secret-key-specific changes this might be a good time to make them.

Hal

________________________________________________________________________
Total Internet Privacy -- get your Freedom Nym at http://www.freedom.net

---

From: [email-masked] (Lutz Donnerhacke)
Date: 23 Mar 2001 07:54:01 GMT

* [email-masked] wrote:
>we should make other changes as well.

There is no need to do so.

>Then, if we're changing the secret key packet format, should the public
>key packet be changed as well,

There is not connection between the public and the secret key format.

>kind of opens a can of worms if we go this way.  On the other hand, given
>that any new key format won't be backwards-compatible, if there are other
>secret-key-specific changes this might be a good time to make them.

I oppose quick changes. OpenPGP needs a deep protocol analysis and a much
easier format. This can't be done in a few weeks.

Our short term solution should be: Encourage the implementors to choose
better storage formats and urge more integrity checks.