Re: [openpgp] ECDH PKESK v5 change

[Daniel Huigens <[e-mail]>]

Hey Aron,

On Tuesday, December 20th, 2022 at 14:36, Aron Wussler wrote:
> In section 12.5 we change the encoded data in the encrypted part of the v5 ECDH PKESK, removing the symmetric algorithm ID.
> 
> 1. Doesn't this effectively remove the binding between session key and PKESK?
> I could reuse the same key packet for a different Sym. Encrypted Integrity Protected Data Packet encrypted with another algorithm.
> Embedding this into the Param of the ECDH KDF could also be very tricky, as we would be mixing info from different packets.

SEIPDv2 has an HKDF step, so the key that actually ends up being used
for encryption is bound to the algorithm ID.

Nevertheless, you could indeed reuse a PKESKv5 packet with an SEIPDv2
packet with a different algorithm, but I don't think that's actually a
problem, in fact it's essentially what e.g. Justus wanted, to be able
to reuse PKESKs for reply-to-all.

> 2. Can we also drop the checksum?
> 
> RFC 3394 contains already a 64-bit checksum, making this effectively a 10-octect checksum.

Yeah, I agree. And actually I think we could remove the padding as well;
since we moved the algorithm ID to the SEIPDv2 packet (in plaintext)
the padding doesn't really hide anything (nor does it seem very valuable
to hide the key length). That way, we could use "plain" AES-KW, which
should simplify things.

Best,
Daniel