Jon Callas wrote:
Recently, I've been asked about adding GOST as a cipher into OpenPGP.
It's needed in Russia and parts of Eastern Europe, where they use it
in banking and government applications.
I gather that there are regulations that state that
only GOST is permitted to be used. (Beyond that, I
don't know any more.)
Is there an objection to finding out what the right thing to do is,
and putting it in the draft? This really consists of allocating an
identifier for it, and specifying the parameters. I'd look to what
they're doing in an S/MIME draft for the right thing.
The only objection I would have is if it help up the
draft. If something else is holding up the draft, no
problems.
It would however be a nuisance if it was "rushed in"
only to find out later that it is ... not quite right. I
gather there are rather a lot of options behind the
simple 'GOST' word? Is this the algorithm where
the S-Boxes aren't specified in the standard?
Without this, the people who need to do it are going to push it into
the private/experimental range, which is not the right thing, nor
scalable.
( There's no reason why they can't get it going in the
private/exp range and then when they are happy,
ask for allocation. That's what it's for, really. But,
whatever.... )
--
News and views on what matters in finance+crypto:
http://financialcryptography.com/