[openpgp] Re: session key length with SEIPDv2

[Falko Strenzke <[e-mail]>]

While I generally agree that consumer guidance should be strict as well 
in order to reveal drastic usage errors of the producer, the problem in 
this specific case is that the official spec doesn't provide either 
guidance so far. Suggesting that the consumer rejects shorter data 
encryption keys in the errata seems prone to cause interoperability 
errors with producers that interpret the spec differently. They might 
for instance always produce 256 bit session keys even when using AES 128 
for the payload encryption. So we can't simply look at it from the 
perspective that a mismatch is a security reduction – it might simply be 
an excessively strong session key from the perspective of the producer.

In my view the consumer guidance should state that a warning or error 
SHOULD be issued if an existing requirement for the security level is 
violated by either the size of the session key or that of the data 
encryption key – rather than checking only the size of one of them. The 
real risk seems to be that when trying to enforce a certain security 
level, an implementation might make the error of just checking the size 
of the session key, because of the two keys that is the one that has 
existed so far.

Falko

Am 08.10.24 um 15:40 schrieb Daniel Kahn Gillmor:
> On Sat 2024-10-05 15:42:19 +0000, Daniel Huigens wrote:
>> All of that is not to say that I'm opposed to consumer guidance, but I
>> think (normative) producer guidance is the more important part and the
>> part that can more unambiguously be shown to have been intended given
>> the above quotes of RFC9580, and thus I think it could go in an erratum?
>> Whereas if we want consumer guidance (for SEIPDv2 and v1) I'd expect
>> it'd have to go somewhere else. But, lmk if you disagree, of course.
> Producer guidance without consumer guidance seems rather toothless to
> me, but i'd be curious to know what the rest of the WG thinks about
> this.
>
> Here's a stab at fairly wishy-washy proposed guidance for both sides
> that tries to explicitly state what i expect is the status quo:
>
>       When producing a message using SEIPD v2 with corresponding PKESKs
>       or SKESKs, The length of the session key MUST equal the key size of
>       the symmetric algorithm used in the encryption container.
>
>       When handling a message that uses SEIPD v2, if the session key size
>       does not equal the key size of the symmetric algorithm used in the
>       encryption container, the consuming implementation SHOULD warn that
>       the message is malformed, and MAY decline to decrypt the message.
>
> This consumer guidance is itself still fairly toothless, but at least it
> describes the range of likely responses that justify the MUST on
> interoperability grounds.
>
> wdyt?
>
>          --dkg
>
> _______________________________________________
> openpgp mailing list [e-mail]
> To unsubscribe send an email [e-mail]
-- 

*MTG AG*
Dr. Falko Strenzke

Phone: [phone]
E-Mail: [e-mail]
Web: mtg.de <https://www.mtg.de>

------------------------------------------------------------------------

MTG AG - Dolivostr. 11 - 64293 Darmstadt, Germany
Commercial register: HRB 8901
Register Court: Amtsgericht Darmstadt
Management Board: Jürgen Ruf (CEO), Tamer Kemeröz
Chairman of the Supervisory Board: Dr. Thomas Milde

This email may contain confidential and/or privileged information. If 
you are not the correct recipient or have received this email in error,
please inform the sender immediately and delete this email.Unauthorised 
copying or distribution of this email is not permitted.

Data protection information: Privacy policy 
<https://www.mtg.de/en/privacy-policy>