>Also note that there's no security proof for the MDC,... I am not sure what aspect of the MDC you would want to prove. The security properties of such constru

>Also note that there's no security proof for the MDC,... I am not sure what aspect of the MDC you would want to prove. The security properties of such constructions are well understood at this point[1]. It is a simple scheme. It has been under scrutiny for 20+ years. It isn't really possible to prove a scheme secure in general. What happens in practice is that it turns out that an assumption is incorrect. The MDC requires few assumptions and is probably more secure than other more complex schemes. >The paper linked there explains why having AD would be useful. I don't find that very compelling. The scheme described talks about a false positive rate. Such a thing would not be acceptable in normal PGP usage. I am also not convinced that such a scheme is impossible without AD. As already mentioned, I am concerned about the ethics of changing a long term standard for no good reason. The users do not deserve the wave of low level interoperability problems such a proposal would create. Usability is a serious issue for end to end encrypted messaging of all types and should be prioritized. [1] https://link.springer.com/content/pdf/10.1007/3-540-44987-6_31.pdf https://link.springer.com/content/pdf/10.1007/3-540-44987-6_...