[openpgp] session key length with SEIPDv2

[Heiko Schäfer <[e-mail]>]

Hello list,

I believe RFC 9580 doesn't explicitly specify the expected/correct 
length of session keys for SEIPDv2, and think this is an oversight.

With SEIPDv1, the session key length - by definition - must equal the 
key length of the symmetric cipher.
However, the construction in SEIPDv2 technically works with session keys 
of any length.

I imagine that the intent in RFC 9580 is that the session key length in 
SEIPDv2 must also equal the key length of the symmetric cipher.
However, with the RFC as it stands, receiving implementations don't have 
clear guidance to reject overly short SEIPDv2 session keys (or 
unreasonably large ones).

This strikes me as an unfortunate risk for the ecosystem: An application 
could produce SEIPDv2 encrypted messages that use one-byte long session 
keys (and send them over risky transports). Multiple libraries would 
currently cheerfully accept and decrypt such a message, giving users the 
(questionable) sense that the message was strongly protected.

Of course one could argue that senders should just do better. But I 
don't find that a fully satisfying perspective.
After all, recipients can very easily reject such dubious messages, and 
surface their fishiness.


If there is indeed no legitimate reason why the length of a SEIPDv2 
session key should ever differ from the symmetric cipher key length, 
then I think we should clarify (with an erratum for RFC 9580?) that:

- The session key length for a SEIPDv2 packet must be equal to the 
symmetric cipher key length.
- Recipients must refuse to decrypt SEIPDv2 packets with session keys of 
differing length.

Thanks,
Heiko


PS: For reference, I have previously raised this point in 
https://gitlab.com/sequoia-pgp/openpgp-interoperability-test-suite/-/issues/146, 
and this issue contains some discussion