[openpgp] Re: Deterministic generation of (symmetric) public key params from private key params

[Daniel Huigens <[e-mail]>]

Hi Vedaal,

To be fair, a well-funded adversary creating 2^64 symmetric keys by themselves would not, by itself, create any issue. There is a 50% chance that two of the keys that the adversary generated share the same private key material, but there is not a 50% chance that the adversary shares a private key with anyone else, unless there are also very many keys with the same timestamp generated by legitimate users/"targets". To find the same private key as any one specific user with a specific timestamp with 50% probability, the adversary would still have to generate 2^127 private keys, which is obviously not feasible.

However, I do think it would be a surprising restriction if we have to say that an OpenPGP deployment is not allowed to use a hardcoded key generation timestamp (for privacy or other reasons), and so relying on that timestamp changing (for legitimate users) does feel a bit sketchy, although it's probably fine in practice.

Best,
Daniel

On Thursday, November 14th, 2024 at 18:45, [e-mail] <[e-mail]> wrote:

> On 11/14/2024 at 10:41 AM, "Justus Winter" <[e-mail]> wrote:
>
>> Interesting. What about also hashing in the other metadata (i.e. the
>> timestamp). Then, the problem arises only if you have 2^64 users
>> creating a symmetric key at the exact same time
>>
>> =====
>>
>> GnuPG allows for a 'fake time' where any time can be listed.
>>
>> So, theoretically, a well-funded, well resourced adversary, can create 2^64 symmetric keys with the same timestamp.
>>
>> vedaal