Re: [openpgp] OpenPGP encryption block modes

[Bruce Walzer <[e-mail]>]

On Wed, Aug 10, 2022 at 09:50:03PM +0000, brian m. carlson wrote:
[...]
> > That raises a question for me as I hold the position that OpenPGP does
> > not need any more block cipher modes. I had the impression that
> > SEIP-MDC (OCFB-MDC) would be relatively fast as the slow part is
> > SHA1. SHA1 is one of the faster cryptographic hashes and is hardware
> > accelerated on common platforms. I assumed that the slowness was
> > because no one had ever bothered to optimize things. Is this true?
> 
> SHA-1 is no longer considered secure, and thus we can't assume that a
> SHA-1 hash of the data intrinsically indicates that it hasn't been
> changed.

I don't think this is correct as stated for normal OpenPGP usage. SHA1
is only broken for collisions. The best an attacker can do is
create two messages that when hashed with SHA1 will come out to the
same value. So SHA1 does in fact prevent an entity other than the
originator from making an undetected change. Fortunately this
distinction is entirely irrelevant for SHA1 use in OCFB-MDC. The hash
used only requires the property of irreversibility.

> Some OpenPGP implementations are trying to avoid known attacks by using
> the same collision-detecting SHA-1 implementation that Git uses, which
> is extraordinarily slow and can't be accelerated due to the need for
> intermediate products.  (This is why moving to Git's new SHA-256
> repositories will tend to improve performance somewhat on modern
> machines, as well as improving security.)

I would be interested in a reference. It would be helpful here to know
how well the workaround actually works in practice. Such a workaround
is not required for OCFB-MDC as it is completely secure using regular
SHA1.

And that is the point we really should address here. We have a working
and well standardized block cipher mode. It seems to make no sense to
add three new block cipher modes for a total of five in the standard
(OCFB still exists and is in current use). We have even had to create
a preferences system just for the block cipher mode. Would any of
this make any rational sense in any other context? Why does it make
sense in this context?

Bruce