Q: Why doesn't --pgp2 warn you if you don't have IDEA

[smu johnson]

On Wed, Aug 11, 2010 at 12:08 AM, Werner Koch <wk at gnupg.org> wrote:

> On Wed, 11 Aug 2010 03:56, rjh at sixdemonbag.org said:
>
> > Possibly.  I am not a developer and do not claim to speak for them.  I
> > would speculate that RFC1991 conformance (PGP 2.6 compatibility) is such
>
> Actually RFC1991 is not complete description of PGP 2.6
>
> BTW, PGP2 is basically broken because it relies on the MD5 algorithm
> which is considered too weak now.  Thus we won't bother to add any more
> compatiblity switch for PGP 2 into GnuPG.
>
>
Yes, it's obviously not a the secure choice, but I don't think it's really
necessary to remove the functionality.  It already warns when using MD5 that
it is insecure, and obviously MD5 is not going to be chosen by default by a
new user.  So what's the problem?

Only someone using the expert switches would know what he's doing and be
able to get GnuPG to use MD5, and still be prompted with the warning that it
isn't a good idea.  So the choice remains with the expert user.

I had a lot of fun decrypting a message from GnuPG using PGP 2.6.3 at work
today and it'd be a shame if this kind of fun geek stuff went away.  Not
only that, about a year or two ago, I sent an e-mail to a PGP 2.6.3i user
and was pretty happy about it.  It was something like a "message in a
bottle" thing where you find an old public key and hope the recipient still
has the private key.  But being forced to dig up old DOS archives to find a
16-bit PGP 2.6.3 in a Windows x64 era because GnuPG removed the
functionality seems like an unnecessary and huge headache to me.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </pipermail/attachments/20100811/73b20c3c/attachment.htm>