Re: [openpgp] OpenPGP encryption block modes

[Bruce Walzer <[e-mail]>]

On Wed, Aug 10, 2022 at 09:50:03PM +0000, brian m. carlson wrote:
[...]
> AES-256-GCM can encrypt 16 KiB chunks at over 6 GB/s on my machine, and
> AES-256-OCB can encrypt similar chunks at over 8 GB/s, whereas a
> hardware-accelerated SHA-1 tops out at 2 GB/s and AES-256-CFB only runs
> at 866 MB/s.  This is a laptop with a Core i7-1280P and 32 GB of RAM
> using OpenSSL 3.0.5[0], which tends to have excellent performance.

So the ratio of OCB vs OCFB-MDC comes out to 8/.866=9.2 . That *is*
significant but does not imply that OCFB-MDC is ridiculously slow. The
0.866 GB/s result strongly implies that there is not any sort of
performance problem for messaging. Since the proposed change is
entirely incompatible with the present encryption, why is this even
being considered as part of OpenPGP? Why is it not being developed as
some sort of high performance, high reliably disk format standard? Why
do we have to bother people doing messaging clients with all this
extra and unneeded complexity? Just a quick list:

* Up to 3 more block cipher modes for a total of 5.

* A chunking system that goes on top of cipher blocking and the packet
  extension blocking to bring the blocking to 3 deep.

* A whole new preference system for block cipher modes that goes on
  top of the existing preference for the block encryption mode.

BTW, why was increased performance for the block cipher mode included
as a goal for the cryptography refresh anyway? So far it does not seem
possible to gain such an increase in a compatible way. Was it ever
considered a possibility?

Bruce