Re: [openpgp] The Argon2 proposal seems incomplete (Draft 6)

[Justus Winter <[e-mail]>]

Bruce Walzer <[e-mail]> writes:

> The Argon2 proposal seems incomplete (Draft 6)
>
> This fell out of a discussion on a different thread. I think I can now
> express this in a more coherent way.

Don't split threads like that.  At best it looks like an obvious attempt
of leaving the dissenting voices behind.

> Argon2 is a hash with a primary benefit of memory hardness intended to
> prevent efficient attacks from GPU/FPGA/ASIC hash crackers.

Argon2 is the winner of the 2015 Password Hashing Competition.  Its
utility is beyond doubt.

> OpenPGP is a messaging standard and has to be such that
> interoperability is possible between different systems. That is at
> odds with normal Argon2 usage.

If you are doing pre-shared key encryption, you have to communicate the
key to the recipient, hence you do know in what context the data will be
decrypted.  Even if you don't, let's say you are archiving some data,
experience tells us that available memory will grow, not shrink, so
whatever memory you can supply now for the encryption, you can be sure
that the future recipient will have enough to decrypt it.

> I think that more work needs to be done here to generate a valid
> proposal. At this point it is not clear to me that such a proposal is
> even possible. We might have to in the end consider other
> approaches. As it is, we are basically dumping a complicated
> technology into a long term standard with all the knobs exposed with
> the hope that someone will come along later and find an effective use
> for it.

It is not complicated.  It is not new.  It is widely implemented, and
the RFC gives recommendation for the parameters.  Note that for the
legacy S2K mechanisms, even though there are multiple knobs, the RFC
gives no guidance whatsoever.

If you have a counter-proposal for a password-to-key derivation
mechanism, please produce a constructive proposal.

Best,
Justus