Miscellaneous questions

[Robert J. Hansen]

Herbert Furting wrote:
> 1) When creating a new UID, why does gpg have a minimum size of 5
> characters? This is not imposed by RFC4880? Where can I report this bug.

It's not a bug.  It's a deliberate design decision on the part of the
GnuPG authors.

> 2) I have a key that is already published to keyservers. Unfortunately
> it uses old SHA1 as hasing algorithm.

I would not recommend this sort of brain surgery on a key.  If you're
that concerned about the use of SHA1, I would suggest just generating an
entirely new key that is entirely to your specifications.

> How can I change this in gpg, that it puts these on 0x1F?

Hack the source.

> 5) Last but not least,... when setting the algorithm preferences gpg
> always automatically adds 3DES, SHA1 and uncompressed. I now that all of
> these are must-implement algorithms. But RFC4880 does not say, that the
> preference subpacktes must include them. It just says it's good behaviour.
> I think the export mode should allow it to not have them set.

Why?  Your reason doesn't make sense.

> the preference subpacktes, I make a statement like saying: I don't care
> what RFC4880 says,.. I consider 3DES as unsafe for my needs and won't
> accept anything using it... same idea goes with the hashing algorithms.

Sorry.  This is not a statement about anything other than "I'm not
following RFC4880's best practice".

If I see that you're omitting 3DES from your preference list, I'm not
going to think you're making a statement about 3DES.  I'm going to think
you're not following RFC4880's best practice.  Other people in the world
are not telepathic, cannot read your mind, and cannot rationally infer
what you want us to infer.  I will happily send you 3DES traffic
regardless, since it happens to be a high preference of mine and it's
automatically going to be on yours.

Incidentally, if you can't articulate solid cryptanalytic reasons why
3DES is an unsafe choice for you, you really shouldn't be arguing
against 3DES.  There's a joke I often tell the undergrad computer
security course here--"3DES: turning brilliant young graduate students
into burned-out alcoholic wrecks since 1974."

3DES has all the aesthetics of a Soviet worker's housing bloc, and just
as much durability.  It is quite slow by modern standards, but it is
ridiculously overdesigned for its task--_ridiculously_ overdesigned.

If there are attacks against 3DES you're worried about, then please
share them with the rest of us so we can be better-informed.

> implementation does) I don't want,.. that anybody sends me uncompressed
> data,.. because I fear those attacks.

If you're this concerned about cryptanalytic attacks, I have to ask how
many heavily-armed Marines you have guarding your key.  You're talking
about adding more armor plating to the vault door of your home.  An
attacker is most likely going to pick up a chainsaw and just cut through
the wall.

It's what I'd do.

Do not fetishize cryptography.  It will not save you.  It is not magic
pixie dust.