Problems understanding IDEA problem :-)

[David Shaw]

On Fri, May 03, 2002 at 05:05:12PM +0200, Thorsten.Delbrouck@guardeonic.com wrote:

> John Doe wants to send encrypted mail to me using "CryptoEx". I'm
> using GPG 1.0.7 (w32) (Hideki Saito's build).
> 
> About CryptoEx: "CryptoEx (...) allows a choice of different
> standards according to requirements, such as the widely used
> protocols OpenPGP (...) This (...) setup guarantees that you can
> securely communicate with all your business partners."

[..]

> Now .... did I make a mistake with my key again or did CryptoEx
> simply pick the wrong cipher algorithm (thus violating the openpgp
> spec) ?

> gpg: encrypted with 1024-bit RSA key, ID AB123456, created 2001-02-20
>       "John Doe <john@doe.com>"
> gpg: encrypted with 2048-bit ELG-E key, ID 4CBAE7B1, created 2002-05-03
>       "Thorsten Delbrouck-Konetzko <thorsten.delbrouck@guardeonic.com>"

Well, there is certainly a problem.  If CryptoEx follows the OpenPGP
spec, What I suspect happened is this:

The John Doe key looks like an PGP 2 style (v3) RSA key, which
generally means "IDEA only".  Since CryptoEx needs a cipher algorithm
that both you and John Doe can handle, it joins John Doe's cipher
prefs (IDEA) with yours (AES, CAST5, 3DES), comes up with no match,
and picks IDEA.

This is legal, but not recommended, according to OpenPGP ("... an
implementation MAY, but SHOULD NOT use IDEA in an algorithm conflict
with a V3 key.").

All in all, yet another reason not to use v3 keys. :(

David

-- 
   David Shaw  |  dshaw@jabberwocky.com  |  WWW http://www.jabberwocky.com/
+---------------------------------------------------------------------------+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson