Re: [openpgp] OpenPGP encryption block modes (Was: The Argon2 proposal seems incomplete (Draft 6))

GCM is in the same category of constructs as OCB. It is not a semantic
mismatch to swap one for the other. The name "AEAD" is also not
(necessarily) exposed to users, it's mainly used internally in the
spec (/ implementation) to describe the category of algorithms used.

Additionally, our reason for wanting to use GCM is also for performance.
For us, GCM is (considerably) faster than OCB, as GCM is implemented
natively in Web Crypto. This makes the implementation both more secure
and faster than what we could ship in JS.

Best,
Daniel

------- Original Message -------
On Tuesday, August 2nd, 2022 at 12:59, Bruce Walzer wrote:

> On Fri, Jul 29, 2022 at 02:54:27PM +0200, Werner Koch wrote:
>
> > On Thu, 28 Jul 2022 19:35, Justus Winter said:
> >
> > > The current SEIPv1+MDC is impossible to implement securely. Efail, one
> > > of the best attacks on OpenPGP ever, is a direct consequence of that.
> >
> > EFail has never been an attack on OpenPGP. It is an attack on the
> > majority of todays mail clients implementations. We have seen other
> > attacks which were more severe.
> >
> > > whether a replacement for the SEIPv1+MDC system is needed.
> >
> > CFB+MDC is a proper encryption system the we came up in 2000 with still
> > no known attacks. It is slow, though. Thus a faster and easy to
> > implement AE mode makes a lot of sense. This is why we started to
> > deploy OCB decryption capability years ago, so that in a few years it
> > can replace the CFB+MDC mode.
>
>
> Greater performance is a legitimate rationale for another block mode. I have been arguing that OpenPGP based systems have been implicitly depending on the inherent modification deterrence of SEIP to the extent that the MDC is mostly ignored. Because of that I have to admit that OCB has much better inherent modification detection. Modifications on OCB damage the block modified, not the next one as with SEIP. So if we had to have another block mode (I am still not convinced of this) then OCB would seem a particularly rational choice.
>
> > The whole new complex "crypto-refresh" AE stuff to support the brittle
> > GCM is a dead end. Well, unless you want to put OpenPGP back into the
> > geek-only domain.
>
>
> I think the problem of extraneous block modes like GCM came from the
> decision to start calling the block mode "AEAD". Once there was an
> apparent slot opened up with that name only then did people start
> thinking of things to drop into that slot. So GCM could be seen as an
> example of an inappropriate graft from another regulatory medium based
> on confusion of terminology.
>
> AEAD isn't even a very accurate term in an OpenPGP context. There is
> no AD (associated data) exposed to the user of such a system. It just
> doesn't work that way.
>
> Bruce
>
> _______________________________________________
> openpgp mailing list
> openpgp@ietf.org
> https://www.ietf.org/mailman/listinfo/openpgp