Stephan Somogyi <openpgp(_at_)lt(_dot_)gross(_dot_)net> writes:
At 19:11 +0200 23.04.2007, Simon Josefsson wrote:
The proposal was to make Camellia a normative reference in the base
OpenPGP document. I see a problem with that.
Having the reference be informational would be OK, as long as there
are no requirements to implement it. Only then can implementers that
wish to conform to the base spec safely ignore Camellia.
I think there are two separate considerations here, and that you may
be conflating them.
If I understand it correctly, the original proposal was to define an
ID number for Camellia. I interpret the intent behind this as wanting
to ensure that, should multiple implementors choose to implement it,
they are using the same ID. Similarly, the desire is for no-one else
to use that same ID for a different cipher.
This to me has nothing at all to do with establishing whether Camellia
is required in a baseline OpenPGP implementation.
Oh, if you interpret the request like that, I have no problem at all.
I believe registering a number for the Camellia algorithm should
happen no matter how many patents there are on it, just to avoid any
risk of number conflicts.
I read the original request differently, because it proposed to add
Camellia as a normative reference.
Given what people have said about NTT's intentions in this area, it
may be worthwhile to pursue and ask them to provide a better patent
license that would guarantee that Camellia can be used freely.
But is the ability for a cipher to be used freely a reasonable
criterion to determine suitability for a slot in the ID list?
No. But I believe only freely usable ciphers, if at all possible,
should be SHOULD or MUST algorithms.
It seems to me that commercial OpenPGP developers may well choose to
implement some algorithms that might not be freely usable, but they
will nonetheless want to be good standards citizens and be as diligent
as possible about ensuring that there are neither ID collisions and
that other implementors use the same ID for the same cipher.
Yes. Sometimes this is handled through an IANA registry.
But
that is a separate problem, and not related to OpenPGP. Until there
is a good license available, I would be against anything more than a
informational reference in the OpenPGP document.
Unless I'm mistaken, all that is needed here is an agreed upon ID
number for the Camellia cipher. Nothing more.
Ok. I probably misunderstood the initial request.
/Simon