updating default digest preferences

[Daniel Kahn Gillmor]

On 07/10/2009 03:10 AM, Werner Koch wrote:
> On Thu,  9 Jul 2009 16:18, dkg at fifthhorseman.net said:
> 
>> preference ordering does is that it precludes the use of stronger
>> digests by every client that respects the ordering.
> 
> You may use personal preferences to change that.  SHA-384/512 is not
> widely enough supported and of no use for an average user.

5-year-old (or older) clients that do not support larger digests would
simply look through the list of preferences until they find one that
they do support, so i'm not sure why widespread support of an algorithm
should influence its placement in the advertised preferences.

Your proposed preference list seems to contain the statement: "If you
support SHA-512 but not SHA-256, please use the even weaker default
digest (SHA-1) instead of SHA-512".  While it would be an odd client
that meets those criteria, it seems even odder to request such a
downgrade (especially given that the preference list is being generated
with a tool that has supported SHA-512 for many years now).  If a client
is capable of using SHA-512, why *wouldn't* the average user want it to
prefer that over SHA-1?

>> deprecating these other stronger digests now.  Are there computational
>> or efficiency issues that i'm unaware of?  Can you explain more?
> 
> SHA-256 and SHA-1 are supported by hardware - the others are not.

I have no specialized hardware that i'm aware of that calculates SHA-1
or SHA-256 sums when i verify or create OpenPGP signatures with GnuPG.
I suspect that most users GnuPG are in the same situation.

In that case, wouldn't it make sense for the minority subset who *do*
have such hardware to change their advertised digest preferences, rather
than making that choice the standard for every other user?

Regards,

	--dkg

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 890 bytes
Desc: OpenPGP digital signature
URL: </pipermail/attachments/20090710/05f0fd2e/attachment.pgp>