Interoperability

[Len Sassaman]

One of my complaints with GnuPG is the over-abundance of different ciphers
and hash algorithms to choose. Now, people are bandying about the idea of
including three new hashes (SHA-256, SHA-384, and SHA-512) as options in
GnuPG.

This would be a mistake, in my opinion. First of all, they are simply too
new to be trusted, and have not been vetted enough. Secondly, they get us
very little presently. When the DSS standard is updated to allow hashes
other than SHA-1, we may wish to revisit this, but until then I would not
use such keys.

Simplify. That is the key to having your crypto applications succeed.

On Tue, 7 May 2002, Leigh S. Jones, KR6X wrote:

> "Johan Wevers" wrote:
>
> > Leigh S. Jones, KR6X wrote:
> >
> > > GnuPG is poised to dominate the field, and its developers
> > > should consider the implications of creating the best possible
> > > tool rather than the most compatible one.  The "idea" patent
> > > has already set PGP and GnuPG widely apart from the
> > > standpoint of interoperability,
> >
> > Not really. Most people who like to remain fully compatible with pgp 2
> > don't care about that patent. Personally, I use IDEA for both personal
> > and buisiness usage - let the patent holders sue me if they like:
> > everyone on this list knows chances on that happening are negligible.
> > That might not be the official Gnu point of view, but I don't care.
> >
>
> I find a great deal of agreement with what you've written,
> perhaps that means our ideas are similar.  Maybe your
> reasons are different.  First, the "idea" patent only applies
> to the US, so you're in no danger of being sued.
>
> The "idea" patent holders probably would only pursue a case
> if an American company (such as Network Associates)
> profits from selling their product without paying royalties --
> then I think they'd believe they deserve a share of the profits.
> Makes sense.  But it does prevent me from doing some things
> that I'd like to do, even if the patent holders stated position
> would be to allow me that freedom, because of company
> policy against ignoring patents or copyrights at my job.
>
> My company wants to stop paying for shipment storage of
> 20 tons of new, automatically generated paperwork yearly, so
> it needs a secure digital signature capability. Looks like it will
> be done with gpg now, but I tried to license PGP command
> line first (the freeware product).  NAI's business plan wouldn't
> allow that, so they are out a few thousand of dollars, and
> coincidentally out of the PGP business.
>
> Now I'm moving my old keys over from "idea" to AES (Rijndael)
> because the US government thinks it's a good cipher.  But,
> the OpenPGP standard should take care of interoperability.
> Interoperability is a moving target.  Standards change.  It's
> best to equip yourself to hit the moving target.  If someone's
> keys say they prefer an SHA-256 hash, then you should
> probably send them an SHA-256 hash.  Maybe they like it
> because its a good hash.  Having the capability improves
> your interoperability rather than damaging it.
>
> Sure, the OpenPGP standard doesn't negotiate algorithms
> for signatures, so vanilla signatures are sometimes a good
> idea.  But if you know that the software that will be used to
> verify a signature accepts SHA-256, then perhaps the
> SHA-256 hash would be better than alternative hashes.  At
> my job I need to specify the verification software together
> with the signature software and options, then validate it all
> together as a package.
>
> "Johan Wevers" wrote:
>
> > Leigh S. Jones, KR6X wrote:
> >
> > > GnuPG with capabilities that extend its interoperability with
> > > existing standards such as SHA-256 makes sense from the
> > > point of view of interoperability, even if there is no support for
> > > these standards in PGP7.1.
> >
> > Indeed. Remaining fully compatible with the windows-only versions is not
> > something I really care about, as long as I'm able to send messages that
> > can be decrypted and verified with them to people who are confined to
> > windows when I want to.
>
> Perfect agreement.  What if I'm running windows and someone
> sends me a signature executed with SHA-256?  Enter sha2.dll.
> Glad to have it.  Thanks, Keith.  Thanks Disastry.
>
>
>
> _______________________________________________
> Gnupg-users mailing list
> Gnupg-users@gnupg.org
> http://lists.gnupg.org/mailman/listinfo/gnupg-users
>

--Len.