Re: [openpgp] Encryption and signature context parameter (Was: OpenPGP encryption block modes)

[Marcus Brinkmann <[e-mail]>]

Hi,

Oh yeah, thanks for pointing out the domain separation strings in those signature schemes. That would work very well together, of course.

Thanks,
Marcus

> Am 19.08.2022 um 13:27 schrieb Daniel Huigens <[e-mail]>:
> 
> Hi Marcus,
> 
> I see, thanks! Yeah, the HKDF already has the packet version number in it, which I assume we'd need to bump if we wanted to add more stuff in the AD. So I think there it shouldn't be an issue, but indeed for signatures it might be needed.
> 
> For the record, some signing algorithms already have a `context` parameter, notably Ed448 which we added to the crypto refresh (and use with an empty context now). In theory, we could use that (and Ed25519ctx) - but for the other algorithms it would be less obvious how to add the context in that case, so I guess it would be easier / simpler to just hash (a length and) the context before the message contents in all cases.
> 
> Best,
> Daniel
> 
> ------- Original Message -------
> On Thursday, August 18th, 2022 at 22:47, Marcus Brinkmann <[e-mail]> wrote:
> 
>> Hi Daniel,
>> 
>>> Am 18.08.2022 um 20:47 schrieb Daniel Huigens <d.huigens=[e-mail] <mailto:d.huigens=[e-mail]>>:
>>>> Here I would suggest to add a variable length field to the AD of every chunk with a two-octet length followed by raw context parameter that would be provided upon encryption and decryption by the implementation.
>>> 
>>> Is there a particular reason for the two-octet length? Can we not simply append the context to what we have now? Not that it would cost much to add a length, just checking if there's some security reason.
>> 
>> Thank you for the question! There is no security reason, you can just append the variable-length context parameter to the AD without a length field, and that is in fact what the prototype implementation that I did for the paper does.
>> 
>> There is just one caveat. If you ever want to add more to the AD, and there is no length field, you have to bump the version number of the v2 SEIPD packet to get separation.
>> 
>> For signing things might be different, as there the document data is already taking up the slot for „variable length data without length field“, so a length field might be needed there (for example, if the context parameter is part of the trailer, an attacker may be able to influence the context parameter to spoof a second trailer that is then valid for a modified document that consists of the original document plus the proper trailer).
>> 
>> Thanks,
>> Marcus
>> 
>> —
>> Dipl.-Math. Marcus Brinkmann
>> 
>> Lehrstuhl für Netz- und Datensicherheit
>> Ruhr Universität Bochum
>> Universitätsstr. 150, Geb. ID 2/461
>> D-44780 Bochum
>> 
>> Telefon: +49 (0) 234 / 32-25030
>> http://www.nds.rub.de/chair/people/mbrinkmann <http://www.nds.rub.de/chair/people/mbrinkmann>
>> 

—
Dipl.-Math. Marcus Brinkmann

Lehrstuhl für Netz- und Datensicherheit
Ruhr Universität Bochum
Universitätsstr. 150, Geb. ID 2/461
D-44780 Bochum

Telefon: +49 (0) 234 / 32-25030
http://www.nds.rub.de/chair/people/mbrinkmann