Re: [openpgp] OpenPGP encryption block modes

["brian m. carlson" <[e-mail]>]

On 2022-08-10 at 14:53:23, Bruce Walzer wrote:
> On Fri, Aug 05, 2022 at 09:41:56AM +0200, Werner Koch wrote:
> > On Thu,  4 Aug 2022 10:26, Bruce Walzer said:
> > 
> > > I thought you guys were mostly doing messaging. Why would performance
> > > be important in that environment? Speaking of messaging, wouldn't you
> > 
> > A major use case is to encrypt bulk data in the range for hundreds of
> > GiByte and often up to several TiByte.  And that is not only for
> > backups.  It matters whether it takes 6 hours or 45 minutes.
> 
> That raises a question for me as I hold the position that OpenPGP does
> not need any more block cipher modes. I had the impression that
> SEIP-MDC (OCFB-MDC) would be relatively fast as the slow part is
> SHA1. SHA1 is one of the faster cryptographic hashes and is hardware
> accelerated on common platforms. I assumed that the slowness was
> because no one had ever bothered to optimize things. Is this true?

SHA-1 is no longer considered secure, and thus we can't assume that a
SHA-1 hash of the data intrinsically indicates that it hasn't been
changed.

Some OpenPGP implementations are trying to avoid known attacks by using
the same collision-detecting SHA-1 implementation that Git uses, which
is extraordinarily slow and can't be accelerated due to the need for
intermediate products.  (This is why moving to Git's new SHA-256
repositories will tend to improve performance somewhat on modern
machines, as well as improving security.)

Even if we ignored all that and pretended like SHA-1 was still secure,
AES-256-GCM can encrypt 16 KiB chunks at over 6 GB/s on my machine, and
AES-256-OCB can encrypt similar chunks at over 8 GB/s, whereas a
hardware-accelerated SHA-1 tops out at 2 GB/s and AES-256-CFB only runs
at 866 MB/s.  This is a laptop with a Core i7-1280P and 32 GB of RAM
using OpenSSL 3.0.5[0], which tends to have excellent performance.

Note that this is for AES-256: AES-128-OCB operates at over 11 GB/s if
you don't need the additional security of a 256-bit key.  This is almost
certainly faster than your disk and possibly even your network.

Using an AEAD is, in this case, both much, much faster (probably over 10
times considering the SHA-1/CFB composition) and substantially more
secure.  There are really no downsides.

[0] openssl speed -evp {sha1|aes-256-ocb|aes-256-cfb|aes-256-gcm}
-- 
brian m. carlson (he/him or they/them)
Toronto, Ontario, CA