Re: [openpgp] AEAD Chunk Size

Werner Koch <> Fri, 08 March 2019 15:40 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 3801912865D for <>; Fri, 8 Mar 2019 07:40:15 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -3.593
X-Spam-Status: No, score=-3.593 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DATE_IN_PAST_96_XX=3.405, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_HI=-5, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id Fzg1wou-dWIM for <>; Fri, 8 Mar 2019 07:40:12 -0800 (PST)
Received: from ( [IPv6:2001:aa8:fff1:100::22]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 22DB9129570 for <>; Fri, 8 Mar 2019 07:40:11 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;; s=20181017; h=Content-Type:MIME-Version:Message-ID:to:References:Date: In-Reply-To:Subject:From:Sender:Reply-To:Cc:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=1/cPjeCBuoXWW2LxPWZFtlRxDNWVSIrfOqb5dK9P0UU=; b=XlNtj5E5DES6TUeEqzw3ZV4wjA hemKttW6rOqcMoYnsDy1o7u3CW0R6bRgBW3FwleTSYdk2MZOqaiyn2nbL/WpIvDEMQkrSxgxLQ8Tc 6DXZsvFHMVoqmcdnH5b0rxqaVRXeOa+cuT2QtUbOAiEzqMXMpyBNCCR7/r/5RXAciWM4=;
Received: from uucp by with local-rmail (Exim 4.89 #1 (Debian)) id 1h2HbV-0007Jn-9R for <>; Fri, 08 Mar 2019 16:40:09 +0100
Received: from wk by with local (Exim 4.84 #3 (Debian)) id 1h2HZx-0005VJ-Pn for <>; Fri, 08 Mar 2019 16:38:33 +0100
From: Werner Koch <>
In-Reply-To: <> (Neal H. Walfield's message of "Wed, 27 Feb 2019 11:51:51 +0100")
Date: Fri, 01 Mar 2019 15:50:15 +0100
References: <>
User-Agent: Gnus/5.13 (Gnus v5.13)
Organisation: GnuPG e.V.
X-message-flag: Mails containing HTML will not be read! Please send only plain text.
Mail-Followup-To: "Neal H. Walfield" <>,
Message-ID: <>
MIME-Version: 1.0
Content-Type: text/plain
Archived-At: <>
Subject: Re: [openpgp] AEAD Chunk Size
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Ongoing discussion of OpenPGP issues." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 08 Mar 2019 15:40:15 -0000


[The mail got stuck somewhere in the IETF mail system - resending]

On Wed, 27 Feb 2019 11:51, said:

> Consequently, I propose not only imposing a reasonable ceiling on the
> chunk size that even small embedded devices with a cortex M0 could
> handle, but to simply fix the parameter to 16 KiB.  It's not clear to

Without sufficient storage a smaller chunk size does not help you in any
way.  You can still run a truncation attack and by that time the
preceding chunks have already been processed in some way because, well,
there was no way to store the entire message.  Without the final chunk
you have an incomplete and thus unauthenticated message because the
sender authenticated the entire message and not certain parts of it.

If you like to adhere in your _implementation_ to some _API_ proposal,
go ahead and use it but the API is not a _protocol_ thing.

Let me repeat it again: The chunking was introduced for just one
purpose: To be able to detect rare transmission errors earlier than at
the end of the message.  For large pipes large chunks are a sensible

Changing the protocol in a way as suggested by you is not an option
anymore.  We can change recommendations, though.



Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.