[openpgp] Re: Deterministic generation of (symmetric) public key params from private key params

[Daniel Huigens <[e-mail]>]

Hi Justus :)

On Wednesday, November 13th, 2024 at 15:03, Justus Winter wrote:
> I don't understand the motivation for the hash seed in the first place.
> Why not derive a mock public key from the secret key, i.e. include
> SHA2-256(persistent symmetric key material) in the algorithm-specific
> bits of the public key packet?

I'm not 100% sure this is safe in all scenarios. For an AES-256 key it
probably is, but for an AES-128 key, due to the birthday paradox, after
"only" 2^64 keys there's a ~50% chance that two people will share a key.

If the encrypted private keys are stored on a server, like Proton does,
then the server can find out which two users share a private key by
looking at the public key material; and ask one user to decrypt a
message of the other user, for example. That seems bad.

We could say that persistent symmetric keys may only be used with >=256
bit keys, but having a separate hash seed just seemed simpler and easier
to reason about.

Best,
Daniel