Page MenuHome GnuPG

GnuPG: Add algorithm info for all kyber choices on certificate generation
Testing, LowPublic

Description

Currently on gpg 2.5.17 the choices for kyber keys look like this:

C:\Users\g10>gpg --full-gen-key
[...]
Your selection? 16
Please select the Kyber variant you want:
   (1) Kyber 768 *default*
   (2) Kyber 1024
   (3) Kyber 768 (X25519)
   (4) Kyber 1024 (X448)

It would be helpful to mention all algorithms for all choices, like:

(1) Kyber 768 (bp256) *default*
(2) Kyber 1024 (bp384)
(3) Kyber 768 (X25519)
(4) Kyber 1024 (X448)

Details

Version
gpg4win-5.0.1 @ win11

Event Timeline

timegrid created this object with edit policy "Contributor (Project)".
gniibe mentioned this in Unknown Object (Maniphest Task).Mon, Feb 9, 7:37 AM

Although it is technicall possible to use all combinations, we should limit in the menu them to those as listed above. Too many algorithms pose an interop problem. Thus we provide brainpool because it is required in Germany and the two IETF curves for the general internet (for those who are playing mitigation against against physical experiments).

According to LibrePGP the above algorithms are SHOULD implement. If there are no string changes we can easily add (bp256) etc.

Sorry for the ambiguity. The request was only about mentioning (bpX) for the first two choices, not to add more combinations.

Like this patch?

diff --git a/g10/keygen.c b/g10/keygen.c
index f88fc5aa8..83f1efb70 100644
--- a/g10/keygen.c
+++ b/g10/keygen.c
@@ -3331,12 +3331,12 @@ const char *
 ask_kyber_variant (void)
 {
   struct {
-    const char *desc;           /* e.g. "Kyber 768"       */
-    const char *variant;        /* e.g. "kyber768_bp256"  */
-    unsigned int de_vs : 1;     /* Allowed in CO_DE_VS.   */
+    const char *desc;           /* e.g. "Kyber 768 (bp256)" */
+    const char *variant;        /* e.g. "kyber768_bp256"    */
+    unsigned int de_vs : 1;     /* Allowed in CO_DE_VS.     */
   } table[] = {
-    { "Kyber 768",      "kyber768_bp256", 1 },
-    { "Kyber 1024",     "kyber1024_bp384", 1 },
+    { "Kyber 768 (bp256)",   "kyber768_bp256", 1 },
+    { "Kyber 1024 (bp384)",  "kyber1024_bp384", 1 },
     { "Kyber 768 (X25519)",  "kyber768_cv25519", 0 },
     { "Kyber 1024 (X448)",   "kyber1024_cv448", 0 },
   };

I haven't tested it, but it looks good

gniibe mentioned this in Unknown Object (Maniphest Task).Mon, Feb 23, 4:04 AM
gniibe changed the task status from Open to Testing.Wed, Feb 25, 5:16 AM