Subject: [openpgp] I-D Action: draft-ietf-openpgp-crypto-refresh-04.txt

From: [email-masked]
Date: Mon, 18 Oct 2021 14:19:13 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Open Specification for Pretty Good Privacy WG of the IETF.

        Title           : OpenPGP Message Format
        Authors         : Werner Koch
                          Paul Wouters
	Filename        : draft-ietf-openpgp-crypto-refresh-04.txt
	Pages           : 136
	Date            : 2021-10-18

Abstract:
   { Work in progress to update the OpenPGP specification from RFC4880 }

   This document specifies the message formats used in OpenPGP.  OpenPGP
   provides encryption with public-key or symmetric cryptographic
   algorithms, digital signatures, compression and key management.

   This document is maintained in order to publish all necessary
   information needed to develop interoperable applications based on the
   OpenPGP format.  It is not a step-by-step cookbook for writing an
   application.  It describes only the format and methods needed to
   read, check, generate, and write conforming packets crossing any
   network.  It does not deal with storage and implementation questions.
   It does, however, discuss implementation issues necessary to avoid
   security flaws.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-openpgp-crypto-refresh/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-04.html

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-openpgp-crypto-refresh-04

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Wed, 20 Oct 2021 17:26:24 -0400

Hi folks--

>    Filename        : draft-ietf-openpgp-crypto-refresh-04.txt

As you can see, the design team has pushed out the latest version of the
crypto refresh draft.

This incorporates variations on several of the features that were in the
older draft-ietf-openpgp-rfc4880bis-draft-10, and some new features
that haven't been incorporated in a previous draft:

Feature inclusions:

 - AEAD packets are now defined (they differ from the older draft-10 in
   a few subtle ways, most notably that the chunk size is more tightly
   constrained, and that what was called the "nonce" is now explicitly
   the IV)

 - AEAD protection of secret key material (note that public key material
   is now included in the encrypted form as additional data)

 - Intended Recipients Subpacket (allows a defense against signature
   replay in redirected encrypted messages)

 - SKESKv5 (works only with AEAD)

 - Argon2 as S2K

 - Curve448: X448 for ECDH, Ed448 for signing

Deprecations:

 - forbid creation of weaker S2K types, except when string is known to
   be high-entropy.

 - more strongly deprecate non-integrity-protected symmetric encryption

 - drop (reserve) bit 0x04 from Features packet ("v5 keys"), due to not
   being actionable and potentially causing interop issues.

Fixes/cleanup:

 - Corrections to the OpenPGP message grammar
 - Corrections to OpenPGP certificate structure
 - Algorithm-specific details are now presented in tabular form, for
   public keys and for specific elliptic curve choices

The design team is meeting regularly, and making good progress in
collaboration.  We hope the larger WG will review the latest draft that
the DT has produced!

You can see (and contribute to) outstanding issues and merge requests at
https://gitlab.com/openpgp-wg/rfc4880bis if you're interested.

The design team has several issues in active discussion that did not
make it into draft-04, but will likely to come up soon:

 - Mandatory-to-implement choices (aka "MTI"): see recent summaries of
   design-team meetings on the openpgp-dt mailing list:
   https://mailarchive.ietf.org/arch/msg/openpgp-dt/zGoNZx95Hh8K4myL3cVOoGc__Uw/
   and
   https://mailarchive.ietf.org/arch/msg/openpgp-dt/yTOXV5JgaoGq6CyhE0Y6yhaQL8c/

 - v5 signatures: see active discussion at
   https://gitlab.com/openpgp-wg/rfc4880bis/-/issues/49

 - v5 keys: see different possible proposed changes at
   https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/77 and
   https://gitlab.com/openpgp-wg/rfc4880bis/-/merge_requests/89

I'm hoping that after the next revision, we can start talking about what
"done" looks like ☺ -- we already have some interoperable tests
happening, which is a good sign.

Note, we also have an upcoming meeting at IETF 112, tentatively
scheduled for Wednesday, 10 November 2021, in Session I.

Happy Hacking,

          --dkg