Re: [openpgp] AEAD Chunk Size

Tobias Mueller <> Sun, 17 March 2019 20:00 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 439D51311E2 for <>; Sun, 17 Mar 2019 13:00:56 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id cLlDDwCKvsAe for <>; Sun, 17 Mar 2019 13:00:54 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 8F9611311E1 for <>; Sun, 17 Mar 2019 13:00:54 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by (Postfix) with ESMTPSA id 44Mqtr007Vz13Bb0; Sun, 17 Mar 2019 21:00:51 +0100 (CET)
Message-ID: <>
From: Tobias Mueller <>
To: "Neal H. Walfield" <>, Derek Atkins <>
Cc: Werner Koch <>,, Vincent Breitmoser <>
Date: Sun, 17 Mar 2019 21:00:51 +0100
In-Reply-To: <>
References: <> <> <> <> <> <> <> <> <>
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.28.5-0ubuntu0.18.04.1
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Archived-At: <>
Subject: Re: [openpgp] AEAD Chunk Size
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Ongoing discussion of OpenPGP issues." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sun, 17 Mar 2019 20:00:56 -0000


On Fri, 2019-03-15 at 12:40 +0100, Neal H. Walfield wrote:
> I'm currently convinced that streaming authenticated plaintext is only
> possible if we use small chunk sizes.  If we allow large chunk sizes
> (e.g., 4 exabytes, which is what the current draft allows), then there
> will be cases where an implementation can stream unauthenticated
> plaintext, but not authenticated data, and, because it can, it will.
> And this is even though pretty much everyone including the IETF (see
> RFC 5116 [1]) agrees that AEAD must only emit authenticated plaintext.
>   [1]
Maybe we're hitting a terminology issue here.
For me, a plaintext is authenticated if the whole ciphertext could be
successfully authenticated. Which seems to be very well in line with the
definition you've linked to.
Now, if you modify a (long) ciphertext that has been broken into chunks
near the end and a decryption routine reveals the first parts of the
decrypted ciphertext, would you agree that revealing those parts of the
plaintext does not meet the definition that you've linked to?
And do you further agree that you would need to find a way to prevent
any plaintext to be revealed unless the full message has been
authenticated correctly in order to match the definition that you've