Re: [openpgp] Backwards compatibility
Daniel Huigens <d.huigens@protonmail.com> Wed, 25 October 2023 12:00 UTC
Return-Path: <d.huigens@protonmail.com>
X-Original-To: openpgp@ietfa.amsl.com
Delivered-To: openpgp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A76A7C151992 for <openpgp@ietfa.amsl.com>; Wed, 25 Oct 2023 05:00:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.103
X-Spam-Level:
X-Spam-Status: No, score=-2.103 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=protonmail.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UkpWPMr2JXBv for <openpgp@ietfa.amsl.com>; Wed, 25 Oct 2023 05:00:24 -0700 (PDT)
Received: from mail-40131.protonmail.ch (mail-40131.protonmail.ch [185.70.40.131]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8CF9C151072 for <openpgp@ietf.org>; Wed, 25 Oct 2023 05:00:23 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com; s=protonmail3; t=1698235220; x=1698494420; bh=t2jgVhPt3JuPPkcbJelGhlWhStkfxHQkb5TZJgcm61s=; h=Date:To:From:Cc:Subject:Message-ID:In-Reply-To:References: Feedback-ID:From:To:Cc:Date:Subject:Reply-To:Feedback-ID: Message-ID:BIMI-Selector; b=AVYIP6ZSOgYgYek8kMQiBWj2SkabWE/LxLfFhPhEAeXVKvC1N4KiibxNwznveBt4v PVsYz7Ow0egYTfbBb7kVtpdnvHb6jSMs6TR4OE5BNTgHeuChBXg0UceZsNVaFZdXxg h05hxzg29Iur2TypG//p3Y43Iay5NY6RpbRkLjMqaovaSmcT7SebAx9985pvyNPM5x RTav1gMBPQ6vFI91VEcVW+XP2IYSZinAfYRFezqOgka7rNmBIBW/0SC626fPcPxcav MWZ4wWBnWsoB5YAHQMSe9zlxMTF/U/vsX1MAjEg3QKKCwQU/6cXq4BXWOdTIpx75pT T9tJUtA7LGG6g==
Date: Wed, 25 Oct 2023 12:00:04 +0000
To: Peter Gutmann <pgut001@cs.auckland.ac.nz>
From: Daniel Huigens <d.huigens@protonmail.com>
Cc: Werner Koch <wk@gnupg.org>, Andrew Gallagher <andrewg=40andrewg.com@dmarc.ietf.org>, Paul Wouters <paul@nohats.ca>, IETF OpenPGP WG <openpgp@ietf.org>
Message-ID: <2fQD4MxeLg_f3HN4DdAna08P1h6TXakys_x_nT4WdS_ASWQR4qYjpAybsLFGCQeSjlOqe7MJ-FZMx5mJ_ct2bN59IxQRbS3oCqrjxZMpM5U=@protonmail.com>
In-Reply-To: <SY4PR01MB62510E0FC5A6306A861AD0E0EEDEA@SY4PR01MB6251.ausprd01.prod.outlook.com>
References: <CBAF59DC-8F4E-4E1B-979B-6838D4F662E0@nohats.ca> <87jzrjx3jc.fsf@jacob.g10code.de> <774b9eea-1d06-c957-dc21-4457989c896d@nohats.ca> <87r0lrulsw.fsf@jacob.g10code.de> <999A1C80-4DF7-4E6D-BBCC-B17E4A9C60F8@andrewg.com> <87il72vfgz.fsf@jacob.g10code.de> <SY4PR01MB62510E0FC5A6306A861AD0E0EEDEA@SY4PR01MB6251.ausprd01.prod.outlook.com>
Feedback-ID: 2934448:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/openpgp/ZTYD5VJsG1k2jJBbn5zIAf5o7d4>
Subject: Re: [openpgp] Backwards compatibility
X-BeenThere: openpgp@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "Ongoing discussion of OpenPGP issues." <openpgp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/openpgp>, <mailto:openpgp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/openpgp/>
List-Post: <mailto:openpgp@ietf.org>
List-Help: <mailto:openpgp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/openpgp>, <mailto:openpgp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 25 Oct 2023 12:00:27 -0000
Hi Peter, In the crypto refresh, the IV is generated by the implementation using an HKDF with a random salt, combined with the chunk counter (see the last paragraph of section 5.13.2 [1]). So there's no risk of IV reuse in a functional implementation. Of course you still need a good source of randomness for the salt, but the same is true for the session key. This is also called out in section 13.10 [2]. Best, Daniel [1]: https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh#version-two-seipd [2]: https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh#CSPRNG On Wednesday, October 25th, 2023 at 13:09, Peter Gutmann wrote: > Werner Koch wk@gnupg.org writes: > > > GCM simply does not belong into OpenPGP. > > > I think a bit more detail would help here, namely mentioning the fact that GCM > fails catastrophically if an IV is ever repeated. It's such a common failure > mode that when I'm auditing crypto code one of the first things I do is > cherchez la GCM [], since it's a great beacon for where the crypto flaws are. > The rule is if GCM is being used then find out of IVs are repeated, or there's > a way to get an IV repeat, or to force an IV repeat. It's unsafe at any speed > and therefore shouldn't be in PGP. > > Peter. > > [] The other one is "cherchez DH being run sideways in an attempt to make it > work like RSA", which is also a rich source of crypto vulnerabilities. In > fact a combination of sideways (static-ephemeral) DH and a fails-on-IV- > reuse stream cipher almost guarantees some vulnerability somewhere. > > _______________________________________________ > openpgp mailing list > openpgp@ietf.org > https://www.ietf.org/mailman/listinfo/openpgp
- [openpgp] Backwards compatibility Paul Wouters
- Re: [openpgp] Backwards compatibility Werner Koch
- Re: [openpgp] Backwards compatibility Paul Wouters
- Re: [openpgp] Backwards compatibility Werner Koch
- Re: [openpgp] Backwards compatibility Andrew Gallagher
- Re: [openpgp] Backwards compatibility Werner Koch
- Re: [openpgp] Backwards compatibility Peter Gutmann
- Re: [openpgp] Backwards compatibility Paul Wouters
- Re: [openpgp] Backwards compatibility Wiktor Kwapisiewicz
- Re: [openpgp] Backwards compatibility Peter Gutmann
- Re: [openpgp] Backwards compatibility Daniel Huigens
- Re: [openpgp] Backwards compatibility Justus Winter
- Re: [openpgp] Backwards compatibility Paul Schaub
- Re: [openpgp] Backwards compatibility Sebastian Schinzel
- Re: [openpgp] Backwards compatibility ilf
- Re: [openpgp] Backwards compatibility Andrew Gallagher
- Re: [openpgp] Backwards compatibility Jonathan McDowell
- Re: [openpgp] Backwards compatibility Werner Koch
- Re: [openpgp] Backwards compatibility Werner Koch