[openpgp] Re: Deterministic generation of (symmetric) public key params from private key params

[Daniel Huigens <[e-mail]>]

Hi Justus :)

On Thursday, November 14th, 2024 at 16:41, Justus Winter wrote:
> Interesting. What about also hashing in the other metadata (i.e. the
> timestamp). Then, the problem arises only if you have 2^64 users
> creating a symmetric key at the exact same time

Yeah, I think it'd probably be safe, but we'd have to write a somewhat
non-trivial security considerations section arguing why it is so, and
detailing the (admittedly very unlikely) scenarios in which it's not.
I'm just not sure it's worth it to save 32 octets?

Also, I'm still not sure if deterministic certificate generation from
the private key material (plus a timestamp, presumably) is even a use
case we should care about - e.g. does Sequoia (or any other library)
even have an API for that? And if so, could it be extended to provide
some algorithm-specific public key material (e.g. the fingerprint seed)
as well?

Alternatively, implementations could offer to deterministically generate
a certificate from a (different kind of) seed, by seeding a CSPRNG or
KDF using it and then generating both the private key material and the
fingerprint seed using that?

Best,
Daniel