Re: [openpgp] OpenPGP encryption block modes

[Werner Koch <[e-mail]>]

On Mon, 15 Aug 2022 09:35, Bruce Walzer said:

> * Up to 3 more block cipher modes for a total of 5.

No.  There shall only be two:

 - CFB+MDC. Which has been deployed since summer 2000 (actually 7 years
   before it has been formally specified in 4880)

 - OCB.  Widely available and interop tested since January 2018.

EAX can be dropped because we don't have any patent problems anymore.

CFB-without-MDC may be implemented to allow decryption of old data (gpg
hides this behind the option --ignore-mdc-error)

> * A chunking system that goes on top of cipher blocking and the packet
>   extension blocking to bring the blocking to 3 deep.

This is part of our the original OCB specification in
draft-ietf-openpgp-rfc4880bis-03 (December 2017)

> * A whole new preference system for block cipher modes that goes on
>   top of the existing preference for the block encryption mode.

Also part of the above specification.  It is actually pretty simple to
add this, given that we already have preferences for compression,
cipher, and hash algorithms.  It could be simplified now that EAX is not
anymore needed. But the existing preference system has been proved to
work very well for introducing new algorithms.

> BTW, why was increased performance for the block cipher mode included

Performance was not a primary goal or at least the original 4880bis
charter - just to have a modern well analyzed AEAD algorithm.  And not
all the second system effect stuff the DT recently introduced.


Salam-Shalom,

   Werner


-- 
The pioneers of a warless world are the youth that
refuse military service.             - A. Einstein