GnuPG Defaults

[Robert J. Hansen]

Kevin Hilton wrote:
> Based on the lack of vulnerabilities of those limited set of 
> algorithms (excluding SHA1 -- another topic entirely)

To use a medical analogy, SHA1 has a hairline fracture, not an outright
break.  It's still working fine, although it's certainly not in shape to
take too many more hits.

> it would seem to be prudent to "refine" the number of acceptable
> algorithms.  When the SHA family is eventually supplanted and
> Camellia cipher officially recognized, I only see this list
> expanding, not shrinking!

And this has been the subject of vigorous argument among the members of
the IETF OpenPGP WG.  There's been some talk about devising a minimal
OpenPGP subset, to make implementing it easier -- I don't recall much
talk about that project lately, though.

But anyway, yeah, the WG knows about it, and a lot of people aren't
happy with it.