Re: [Cfrg] possibly dumb question about the opus codec and padding

Hi Jon,

On Jun 6, 2012, at 9:25 PM, Jon Callas wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> I might need to clarify my remarks a bit.
> 
> I don't think a few bits of known plaintext is a serious issue. I mean heck, pick just about any XML document and it's got an entire *block* of known plaintext in it via its XML/DTD header.
> 
> On the other hand, there are a number of problems including the Mister/Zuccherato attack on OpenPGP and the Paterson et al. attack on SSH that boiled down to known plaintext. Add to that the PKCS1 attacks, and any number of padding oracles, it can't just be waved away.

This is a good point: known plaintext can make chosen-ciphertext attacks easier, even if the underlying block cipher resists exabytes of known plaintext.  I think the main lesson from this is: use authenticated encryption.   But I think it is reasonable to say that avoiding known plaintext is a good idea if it is not possible to ensure that encryption uses AE.

David

> 
> Back to the first hand, zeroing out a field isn't a serious issue, and I don't mean to imply that it is.
> 
> But moving on to the third hand, worrying about a few bytes of covert channel is equally as daft.
> 
> My larger point was that saying you MUST zero a field to stop a covert channel is no more (nor less) sensical than saying you MUST NOT zero it to stop known plaintext. It's sort of, "I'll see your paranoia and raise you one." Especially when that MUST for zeroing is followed up with a MUST accept non-zero. 
> 
> That's why I opined that changing the MUST to a SHOULD is a good idea. I truly believe that one SHOULD zero all unused bits because of cleanliness. It's just a good idea. 
> 
> If you don't like changing that MUST to a SHOULD on zeroing, then at least change the MUST accept to MUST reject. If you're going to legislate, have a backbone about your legislation.
> 
> 	Jon
> 
> 
> -----BEGIN PGP SIGNATURE-----
> Version: PGP Universal 3.2.0 (Build 1672)
> Charset: us-ascii
> 
> wj8DBQFP0AMRsTedWZOD3gYRArMAAKDOj78r2s+05WDeO6cWDvdPAeYz1QCeNbOO
> oZm9XwLUmxpOFzPI0+SDSq4=
> =fqjl
> -----END PGP SIGNATURE-----
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg