[openpgp] Re: session key length with SEIPDv2

[Falko Strenzke <[e-mail]>]

Am 09.10.24 um 15:27 schrieb Daniel Kahn Gillmor:
> On Tue 2024-10-08 16:45:02 +0200, Falko Strenzke wrote:
>> Suggesting that the consumer rejects shorter data encryption keys in
>> the errata seems prone to cause interoperability errors with producers
>> that interpret the spec differently.
> Do we know of any producers that interpret the spec differently today by
> using shorter session keys?

No, I don't know anyone. However, I think when I wrote the code for RNP 
some time ago, I made the mistake of not checking the size of the 
session key. So I conclude others might make the same mistake.

>
>> They might for instance always produce 256 bit session keys even when
>> using AES 128 for the payload encryption.
> Sure, they *might*, but does anyone?  now is the time to produce clear
> guidance to make sure the expectations are widely understood.  Do you
> object to the MUST requirement on producers that Daniel Huigens
> proposed?
No, I don't object. This cannot create any interop problems.
>
>> In my view the consumer guidance should state that a warning or error
>> SHOULD be issued if an existing requirement for the security level is
>> violated by either the size of the session key or that of the data
>> encryption key – rather than checking only the size of one of them.
> It sounds like you're saying that there is an additional thing --
> besides the session key -- that can be mis-sized (and is underspecified
> in RFC 9580).  What do you mean by "the data encryption key" in this
> context?  If you mean the output of the KDF during PKESKv6/SKESKv6
> consumption, isn't that size explicitly determined by the symmetric
> algorithm in the SEIPDv2 packet?  Under what circumstance might it be
> sized differently?
Clearly it can't be sized differently. And that's not what I said. I 
said "... an existing requirement for the security level is
violated ... ". That was referring to an application specific (or 
similar) requirement for the key size, that is external to the OpenPGP spec.
>> The real risk seems to be that when trying to enforce a certain
>> security level, an implementation might make the error of just
>> checking the size of the session key, because of the two keys that is
>> the one that has existed so far.
> Can you translate this into explicit guidance that you think should have
> been included in RFC 9580?

Not sure if that's worth the effort right now, as we are still 
discussing. I think we agree already on the MUST for the producer. The 
question that remains is whether there should be an equivalent MUST for 
the consumer. I think the main question is how well readers of RFC 9580 
will be aware of the errata. I have no experience with that, but my 
guess would be that it might not have the same reach as RFC 9580. That 
is what my concerns about a strict rule for the consumer are based on. 
How do you see this?

Falko

>
>       --dkg
>
> _______________________________________________
> openpgp mailing list [e-mail]
> To unsubscribe send an email [e-mail]
-- 

*MTG AG*
Dr. Falko Strenzke

Phone: [phone]
E-Mail: [e-mail]
Web: mtg.de <https://www.mtg.de>

------------------------------------------------------------------------

MTG AG - Dolivostr. 11 - 64293 Darmstadt, Germany
Commercial register: HRB 8901
Register Court: Amtsgericht Darmstadt
Management Board: Jürgen Ruf (CEO), Tamer Kemeröz
Chairman of the Supervisory Board: Dr. Thomas Milde

This email may contain confidential and/or privileged information. If 
you are not the correct recipient or have received this email in error,
please inform the sender immediately and delete this email.Unauthorised 
copying or distribution of this email is not permitted.

Data protection information: Privacy policy 
<https://www.mtg.de/en/privacy-policy>