Re: [openpgp] Partial review of the crypto refresh

[Marcus Brinkmann <[e-mail]>]

Hi,

> Am 24.11.2022 um 14:53 schrieb Daniel Huigens <d.huigens=[e-mail]>:
>> 3.2.  Multiprecision Integers
>>   (...)
>>   Also note that when an MPI is encrypted, the length refers to the
>>   plaintext MPI.  It may be ill-formed in its ciphertext.
> 
> This note has always confused me. Does someone know what it means?

It means what you understood it to mean, that encryption for MPIs is not format-preserving. And yes, it is obvious to us today.

>> 3.7.2.  String-to-Key Usage
> 
> I think what is potentially missing from this section is some guidance
> about "Iterated and Salted S2K", e.g. hinting that it is not very
> strong, or at least that a high octet count should be used. For
> example, we could append to this section:
> 
>   If Argon2 is not available, Iterated and Salted S2K MAY be used if
>   care is taken to use a sufficiently high octet count. However, this
>   method does not provide memory-hardness, unlike Argon2.

There is no octet count representable in any variant of S2K that I would consider safe to use. I agree that there should be guidance, but I would suggest that the guidance should be that S2K should only to be used with a strong passphrase. If a sufficiently strong passphrase is chosen, the variant of S2K chosen does not matter anymore. To give some concrete numbers:

The count consists of a "mantisse" between 16 and 31, and an exponent (to basis 2) between 6 and 21. The total count is mantisse*2^exponent, which is a number between 1024 and 65,011,712. With a blocksize of 512 bits (SHA-1, SHA-2), we have to divide by 64, giving an iteration count of up to approx. 1M. Computing SHA-1 can be done very quickly using standard CPUs (~100MH/s), GPUs (~20 GH/s), and dedicated ASICs (such as used for Bitcoin mining, total network capacity ~160 Million TeraHash/s!). We can now compute how hard it is to brute-force a PGP password. With a single GPU (such as an RTX3090 with 23 GH/s) and 1M H/Password, we are looking at 2.3M password guesses per second. A stronger hash function only reduces this by a small factor (SHA-256: Faktor 2.3, SHA-512: Faktor 7), but really the only viable option here is a much stronger password. Using a uniformly distributed random password from a 64-letter alphabet (a-zA-Z0-9+/) and a password length of 14 characters (= 2^84 passwords), you can pretty much ignore the PGP S2K settings for now (ignoring QC).

Suggestion:

  If Argon2 is not available, Iterated and Salted S2K MAY be used if
  care is taken to use a high octet count and a strong passphrase.
  However, this method does not provide memory-hardness, unlike Argon2.

Thanks,
Marcus

—
Dipl.-Math. Marcus Brinkmann

Lehrstuhl für Netz- und Datensicherheit
Ruhr Universität Bochum
Universitätsstr. 150, Geb. ID 2/461
D-44780 Bochum

Telefon: +49 (0) 234 / 32-25030
http://www.nds.rub.de/chair/people/mbrinkmann