| 1 |
On Tuesday, July 3, 2018 9:29:53 AM EDT Michał Górny wrote: |
| 2 |
> Hi, everyone. |
| 3 |
> |
| 4 |
> Here's a series of patches for GLEP 63 (key policies). The first three |
| 5 |
> patches are merely editorial changes. The fourth is an actual |
| 6 |
> recommended policy change. |
| 7 |
> |
| 8 |
> The editorial changes are: |
| 9 |
> |
| 10 |
> 1. Using 'OpenPGP' instead of 'GPG' where appropriate. |
| 11 |
> |
| 12 |
> 2. Replacing 'RSAv4' with more correct term. |
| 13 |
> |
| 14 |
> 3. Clarifying the sentence on minimal key requirement to make it clear |
| 15 |
> that dedicated signing subkey is also part of it. |
| 16 |
> |
| 17 |
> The policy change is changing the recommendation from RSA-4096 |
| 18 |
> to RSA-2048. This does not require developers to reroll their RSA-4096 |
| 19 |
> keys but aims to prevent people unnecessarily replacing RSA-2048 with |
| 20 |
> RSA-4096. |
| 21 |
> |
| 22 |
> The new recommendation matches what GnuPG FAQ suggests [1] (see 11.4, |
| 23 |
> 11.5). Long story short, RSA-4096 is only a little stronger than |
| 24 |
> RSA-2048 while it is much slower. If someone really wants to use it, |
| 25 |
> sure; but generally we shouldn't be encouraging people to use it. |
| 26 |
> |
| 27 |
> [1]:https://www.gnupg.org/faq/gnupg-faq.html#no_default_of_rsa4096 |
| 28 |
> |
| 29 |
> -- |
| 30 |
> Best regards, |
| 31 |
> Michał Górny |
| 32 |
> |
| 33 |
> Michał Górny (4): |
| 34 |
> glep-0063: Use 'OpenPGP' as appropriate |
| 35 |
> glep-0063: RSAv4 -> OpenPGP v4 key format |
| 36 |
> glep-0063: Clarify dedicated signing subkey in minimal reqs |
| 37 |
> glep-0063: Change the recommended RSA key size to 2048 bits |
| 38 |
> |
| 39 |
> glep-0063.rst | 44 ++++++++++++++++++++++++++++---------------- |
| 40 |
> 1 file changed, 28 insertions(+), 16 deletions(-) |
| 41 |
|
| 42 |
Patches look good to me. I think now would be a good time to address other |
| 43 |
verbage too. e.g. recommendations should be requirements etc |
Archives