[openpgp] Re: session key length with SEIPDv2

[Daniel Kahn Gillmor <[e-mail]>]

On Tue 2024-10-08 16:45:02 +0200, Falko Strenzke wrote:
> Suggesting that the consumer rejects shorter data encryption keys in
> the errata seems prone to cause interoperability errors with producers
> that interpret the spec differently.

Do we know of any producers that interpret the spec differently today by
using shorter session keys?

> They might for instance always produce 256 bit session keys even when
> using AES 128 for the payload encryption.

Sure, they *might*, but does anyone?  now is the time to produce clear
guidance to make sure the expectations are widely understood.  Do you
object to the MUST requirement on producers that Daniel Huigens
proposed?

> In my view the consumer guidance should state that a warning or error 
> SHOULD be issued if an existing requirement for the security level is 
> violated by either the size of the session key or that of the data 
> encryption key – rather than checking only the size of one of them.

It sounds like you're saying that there is an additional thing --
besides the session key -- that can be mis-sized (and is underspecified
in RFC 9580).  What do you mean by "the data encryption key" in this
context?  If you mean the output of the KDF during PKESKv6/SKESKv6
consumption, isn't that size explicitly determined by the symmetric
algorithm in the SEIPDv2 packet?  Under what circumstance might it be
sized differently?

> The real risk seems to be that when trying to enforce a certain
> security level, an implementation might make the error of just
> checking the size of the session key, because of the two keys that is
> the one that has existed so far.

Can you translate this into explicit guidance that you think should have
been included in RFC 9580?

     --dkg