Re: [openpgp] OpenPGP encryption block modes (Was: The Argon2 proposal seems incomplete (Draft 6))

[Daniel Huigens <[e-mail]>]

On Thursday, August 4th, 2022 at 11:26, Bruce Walzer wrote:

> I thought you guys were mostly doing messaging. Why would performance
> be important in that environment? Speaking of messaging, wouldn't you
> strongly prefer the most compatible mode? That is going to be
> SEIPD-MDC for the foreseeable future. Why would either OCB or GCM be
> of any particular interest?

I am speaking with OpenPGP.js maintainer hat on. The library doesn't
assume any particular use case and there are definitely use cases where
performance matters.

> How would a more secure library make the overall system more secure?
> The javascript is still going to be handling the plaintext. We are
> only talking about the block cipher mode here, not the cipher
> itself. That doesn't seem like something that could create a side
> channel by itself.

Well - Web Crypto only exposes block cipher modes. In theory, we could
implement AES-OCB on top of AES-CBC, of course, by calling the latter
for every block, but the overhead of calling the (asynchronous) API for
every block would likely make that infeasible. So, in practice, for OCB
we end up using a JS implementation of the block cipher as well,
whereas for GCM we can use the native implementation.

Best,
Daniel