Re: [openpgp] OpenPGP encryption block modes (Was: The Argon2 proposal seems incomplete (Draft 6))

[Phillip Hallam-Baker <[e-mail]>]

+1

If it wasn't for the patents issue, GCM would never have been invented. The
problem was patents, plural, not just the ones held by the OCB inventor.

GCM was created for TLS which is a Data in Motion control and has always
accepted the speed/security tradeoff of using a stream cipher. AES-GCM is a
stream cipher even though it uses a block encryption primitive.

OpenPGP is a Data at Rest control and so we have to consider the security
of the data over decades rather than days. Unless you are someone of great
importance, your TLS traffic is not going to be among the encrypted data
considered interesting enough to save. Your OpenPGP data on the other hand
is going to sit on mail servers for centuries.

So OCB as a MUST and GCM as a MAY make sense. I think it is appropriate to
push back on proposals to support GCM but in this case, there seems to be a
decent enough argument for it.



On Wed, Aug 3, 2022 at 8:33 AM Stephen Farrell <[e-mail]>
wrote:

>
> Hiya,
>
> On 03/08/2022 06:54, Peter Gutmann wrote:
> > there's no reason to prefer the
> > incredibly brittle and significantly less efficient GCM (or CCM) over OCB
>
> For clarity. The current draft prefers OCB by making
> it a MUST implement, over GCM which is a MAY implement.
>
> S.
> _______________________________________________
> openpgp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/openpgp
>