Re: [openpgp] First remarks on the last I-D

[Jon Callas <[e-mail]>]

As charming as it is to be considered an authority, I decline it. Moreover, my advice on this issue is merely to be careful, especially with GCM. GHASH is brittle as all heck; someone's going to get it wrong and it will be a brouhaha we don't need. I think our past foray into Elgamal signatures is relevant, as it was also something cool but brittle and it blew up in our face.

That cascades into the FIPS 140 issue, and that that's actually important for widespread use of the standard, particularly because there are related standards worldwide that either directly descend from FIPS 140, or people wanted something better. That larger goal does not *require* GHASH. There are plenty of other options: OCB if we need the speed, I don't think we do; CCM is safe and boring and explicitly on lots of lists; EAX is just fine it's just a spite mode; rolling one's own check with CMAC/OMAC or HMAC is also totally fine; SIV is also nice. Pick two.

In as much as I am an authority, my advice is to err on the side of safety. Peter used to make the wonderful snarky comment that OpenPGP would do whatever the new thing was. That made sense in the nineties and aughties. It's no longer a good strategy. Moreover, we are no longer in an era where memory sizes are as constrained as they were. The hot microcontroller of our era is the Cortex M0, not the 8051. I recently worked on a project that had an M0+ with an AES core along side it. It was so nice not to have to bend into a pretzel to get decent security.

Anyway, brittle things *will* bite us in the ass, we know this because when we were clever in the past, we got bitten in the ass by our own cleverness. Go pick something safe, there are plenty of options.

	Jon