Re: [Openpgp-dt] Additional AEAD key separation needed?

[Stephen Farrell <[e-mail]>]

Thanks Daniel, that's useful input. Bit more below...

On 17/05/2022 16:10, Daniel Huigens wrote:
> Hi there,
> 
>> The additional key separation is described in 5.5.3 [3] where
>> it says: "If the string-to-key usage octet is 253, the key
>> encryption key is derived using HKDF (see [RFC5869]) to provide key
>> separation."
> 
> The quoted section of the spec is for encrypted keys, while it's easiest
> to understand the change (and justification) from the section about
> messages, e.g. 5.14.2 [1], which also describes how HKDF is used and
> says that "The KDF mechanism provides key separation between cipher and
> AEAD algorithms." So I would quote that instead, unless Werner's
> complaint is specifically about encrypted keys (but I don't think
> it is, or at least if so it's not clear to me from the email).

Good point. I'll make that change.

> 
>> The justification is for better safety if the
>> same key is used with different AEAD modes, but in particular
>> GCM.
> 
>  From the phrasing, it sounds somewhat like the attack can be prevented
> by the sender (by not using the same key with different AEAD modes),
> but the AEAD mode of a message could be controlled by an attacker; so I
> would say something like "... if a key is used with a different AEAD
> mode than intended ...". I would perhaps quote [2] for the description
> of this attack and the possible countermeasures in section 3.2.

Will do.

> 
>> The counter-argument is that such separation isn't needed
>> for OCB (it was added for GCM) and that OCB code has been
>> deployed with existing ciphertexts out there already so
>> this change breaks interop for no real benefit.
> 
> Here I would perhaps just mention that the original reason to add GCM
> was for FIPS compliance reasons, based on a suggestion at IETF 112.
> Additionally, at least for asymmetrically encrypted messages we didn't
> break interop (since we specified v2 SEIPD instead of the AEAD packet),
> and I think those are the main/only ones that are "out there already".
> But, I can also bring this up on the mailing list instead once you send
> the email, of course; as I suppose whether or not this is the case is
> quite central to this discussion.

Yeah, I think those points would be better as part of the
discussion on the list if that's ok.

Cheers,
S.

> 
> Best,
> Daniel
> 
> [1]: https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-05#section-5.14.2
> [2]: https://www.ndss-symposium.org/wp-content/uploads/2017/09/10_4_0.pdf