Jon Callas <jon(_at_)callas(_dot_)org> writes:
e) update S2K with something more modern (PBKDF2, HKDF, scrypt?),
deprecate all the other mechnanisms explicitly
Agree completely on just using PBKDF2.
You could put other more modern password grinders in, or even leave it open
for new technologies to be introduced easily.
With any luck the PHC will be done by the time any new PGP RFC is published,
so there'd be a well-designed, attack-resistant password-processing function
ready to use.
Peter.
_______________________________________________
openpgp mailing list
openpgp(_at_)ietf(_dot_)org
https://www.ietf.org/mailman/listinfo/openpgp