Re: [openpgp] Encryption and signature context parameter (Was: OpenPGP encryption block modes)

[Marcus Brinkmann <[e-mail]>]

Hi Daniel,

> Am 18.08.2022 um 20:47 schrieb Daniel Huigens <d.huigens=[e-mail]>:
>> Here I would suggest to add a variable length field to the AD of every chunk with a two-octet length followed by raw context parameter that would be provided upon encryption and decryption by the implementation.
> 
> Is there a particular reason for the two-octet length? Can we not simply append the context to what we have now? Not that it would cost much to add a length, just checking if there's some security reason.

Thank you for the question! There is no security reason, you can just append the variable-length context parameter to the AD without a length field, and that is in fact what the prototype implementation that I did for the paper does.

There is just one caveat. If you ever want to add more to the AD, and there is no length field, you have to bump the version number of the v2 SEIPD packet to get separation.

For signing things might be different, as there the document data is already taking up the slot for „variable length data without length field“, so a length field might be needed there (for example, if the context parameter is part of the trailer, an attacker may be able to influence the context parameter to spoof a second trailer that is then valid for a modified document that consists of the original document plus the proper trailer).

Thanks,
Marcus

—
Dipl.-Math. Marcus Brinkmann

Lehrstuhl für Netz- und Datensicherheit
Ruhr Universität Bochum
Universitätsstr. 150, Geb. ID 2/461
D-44780 Bochum

Telefon: +49 (0) 234 / 32-25030
http://www.nds.rub.de/chair/people/mbrinkmann