Re: [openpgp] Proposed WG charter

Werner Koch <wk(_at_)gnupg(_dot_)org> writes:

> On Tue,  2 Jun 2015 12:43, iang(_at_)iang(_dot_)org said:
>
> > I think the reality of OpenPGP's lifecycle is that we are going to be
> > dealing with legacy implementations and algorithms anyway, and just
> I don't think that "legacy" is an appropriate term here.  In contrast to
> many other protocols (e.g. IP) we need to care about data at rest.
> There are huge amounts of encrypted or signed data on disks and tapes
> which eventually need to be decrypted. 
>
> It might be good to think of OpenPGP data like the tar format and not
> like http/smtp/xmpp.
It might help to suggest (in the specification) that OpenPGP
implementations MAY implement decrypt support for older crypto
algorithms but MUST NOT encrypt using them.

Otherwise I suspect that implementations might accidentally (or not) end
up implement both encrypt and decrypt because that is the natural way of
implementing crypto, and supporting both variants simplify testing (you
can test roundtrips).  However doing that is bad for security.

/Simon

signature.asc
Description: PGP signature

_______________________________________________
openpgp mailing list
openpgp(_at_)ietf(_dot_)org
https://www.ietf.org/mailman/listinfo/openpgp