Re: [openpgp] AEAD Chunk Size

[Marcus Brinkmann <[e-mail]>]

Hi,

Just to set the record straight: I made two very specific actionable
proposal on this very list 9 months ago.

* Limit the maximum chunk size to a small value:


https://mhonarc.domainunion.de/archive/html/ietf-openpgp/2018-06/msg00029.html

* Forbid outputting unauthenticated plaintext:


https://mhonarc.domainunion.de/archive/html/ietf-openpgp/2018-06/msg00030.html

Also, I think it is instructive to look at the history of the chunk size
and how we got here in the first place. This is the original proposed
text by Brian M. Carlson:

> An implementation MUST support chunk size octets with values from 0 to
10.  An implementation MAY support other chunk sizes.  Chunk size
octets with values larger than 127 are reserved for future extensions.

https://gitlab.com/bk2204/rfc4880bis/commit/353520abd5be34d9980a0f1ea77a07ba1837d03a

This is what the editor put into the draft standard without discussion:

> An implementation MUST support chunk size octets with values from 0 to
56.  Chunk size octets with other values are reserved for future
extensions.

https://mhonarc.domainunion.de/archive/html/ietf-openpgp/2017-07/msg00010.html

His reasoning was this: "Given that larger values are optional,
implementations will need limit C to 10.  I consider this too low for
practical purposes.  We should require all implementations to support
the same range. Given that we have a 64 bit counter the maximum value
for C should be 57 - I would even say 56 so that we avoid signed and
signed problems in the number of octets."

So, here is an actionable item: Go back to the original proposal by
Brian M. Carlson. It gives implementations a reasonable limit to stick
to, while it allows for larger chunks for special use cases.

Thanks,
Marcus