Re: [openpgp] AEAD Chunk Size

[Werner Koch <[e-mail]>]

Hi!

[The mail got stuck somewhere in the IETF mail system - resending]

On Wed, 27 Feb 2019 11:51, [e-mail] said:

> Consequently, I propose not only imposing a reasonable ceiling on the
> chunk size that even small embedded devices with a cortex M0 could
> handle, but to simply fix the parameter to 16 KiB.  It's not clear to

Without sufficient storage a smaller chunk size does not help you in any
way.  You can still run a truncation attack and by that time the
preceding chunks have already been processed in some way because, well,
there was no way to store the entire message.  Without the final chunk
you have an incomplete and thus unauthenticated message because the
sender authenticated the entire message and not certain parts of it.

If you like to adhere in your _implementation_ to some _API_ proposal,
go ahead and use it but the API is not a _protocol_ thing.

Let me repeat it again: The chunking was introduced for just one
purpose: To be able to detect rare transmission errors earlier than at
the end of the message.  For large pipes large chunks are a sensible
choice.

Changing the protocol in a way as suggested by you is not an option
anymore.  We can change recommendations, though.


Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.