[openpgp] Re: pure vs. pre-hash in FIPS 204 and 205

[Andrew Gallagher <[e-mail]>]

On 29 Aug 2024, at 17:21, Phillip Hallam-Baker <[e-mail]> wrote:
> 
> I am also committed to hash-then-encrypt. It is the structure we adopted long ago and I don't see a good argument for changing. If we have a 1TB Zip file and it already has a SHA-2-512 digest in the checksum, we want to use that, not compile another digest. And I think we should use the same approach for certificates and assertions.

I don’t understand this. Do you mean hash-then-sign? And if so, I’m not sure how a zipfile checksum is relevant…?

> The manifest approach is actually superior though. Especially for OpenPGP because we should be signing the content metadata and not just the content. A semantic substitution attack is a much bigger threat than digest. Constructing a digest is very hard, constructing a PDF that reads as a legitimate JPEG is just hard and I can't remember which flip they did but I am pretty sure I remember an attack of that type.

IMO if we want to sign content metadata in a standardised way it should be done at the OpenPGP layer, via e.g. signature subpackets as we have discussed previously. This way, it is handled independently of the underlying signature algorithms. I don’t think combining these two problems makes either one easier to solve.

A