Re: [openpgp] Choices for AEAD modes [was: AEAD and Rome]

[Justus Winter <[e-mail]>]

Werner Koch <[e-mail]> writes:

> On Tue, 14 Jun 2022 19:40, Daniel Kahn Gillmor said:
>
>>  d) we can revert to rfc4880bis-10's AEAD packet framing and key
>>     schedule, with its table of AEAD modes, without guarantees of key
>>     separation, and without GCM, but switched to OCB as the MTI mode.
>
> Yes, this is what has been deployed worldwide for years in millions of
> installations (decryption wise) and is meanwhile in active use.

It is no-ones fault but your own that you chose to distribute software
that implements a standard that hasn't been finalized.  And now you are
trying to turn that into an argument to make OpenPGP less secure.

Also, as has been pointed out, "bis-style" AEAD can still be supported
to some extend.  So the crypto refresh is not making existing
ciphertexts unreadable.

> After consensus in the WG!

If you had all that consensus in the WG back then, maybe you should
have actually produced a revision to RFC4880?

You keep alluding to the past, to the 2000s.  That was over twenty years
ago.  Things change.

draft-ietf-openpgp-crypto-refresh-06 represents a broad consensus among
the community: members of most major OpenPGP implementations came
together and worked on the text in the design team.  Represented were
GnuPG, RNP, GopenPGP, OpenPGP.js, and Sequoia.

The AEAD scheme we are proposing isn't hard to implement.  In fact,
there are prototypes for GnuPG and Sequoia.

If you have concrete concerns, then by all means, do speak up.  However,
"this is different from what I've been doing" isn't a valid concern.

Justus