Re: [openpgp] Disadvantages of Salted Signatures

[Andrew Gallagher <[e-mail]>]

On 11 Dec 2023, at 16:43, Stephan Verbücheln <[e-mail]> wrote:
> 
> I believe, the following two questions are still worth debating because
> the mandatory salt does not come at zero cost.
> 
> Is it practically relevant?
> Hash algorithms which are vulnerable to collisions should not be used
> anyway. SHA-1 was deprecated in 2011, a long time before that attack
> was demonstrated.

OpenPGP is a high-latency communications protocol with roundtrips often measured in decades. It currently supports artifacts generated in the 1990s, and will do so well into the foreseeable future. There is therefore value in insuring against speculative weaknesses no matter how remote they may currently appear.

> Does it make sense to have it mandatory or default?
> In most cases, PGP users sign their own data (e-mails, software
> tarballs etc.). It could nevertheless be default for “certify”
> operations.

IMO there is value in defing a single signature format for all use cases rather than one deterministic one and one nondeterministic one. If deterministic signatures are required in specialised applications, they could be achieved by other means, e.g. a verifiable-seed PRNG. This is currently out of scope and would need to be signalled via some novel or out-of-band mechanism, however there are other parts of the spec where verifiable-seed randomness may be useful (padding comes to mind) and we could potentially treat these as a general class of problem in a future document. Alternatively, as discussed previously, an application that requires determinism could allow the salt to be externally forced in the verification mode. I therefore don’t believe lack of determinism in the spec is a blocker.

A