Re: [openpgp] First remarks on the last I-D

[Jon Callas <[e-mail]>]

> On Jun 10, 2022, at 06:54, Paul Wouters <[e-mail]> wrote:
> 
> On Wed, 8 Jun 2022, Jon Callas wrote:
> 
>> However, GCM mode is not required for FIPS. It is neither necessary nor sufficient. PGP was the very first software-only FIPS 140 module, over twenty years ago. If someone is claiming that they need GCM mode for FIPS, they're mistaken.
> 
> Well, if that FIPS compliance was achieved with 3DES, at this point that would be
> a problem as 3DES has been sunset. What non-GCM encryption algorithm is
> FIPS approved and supported by OpenPGP ?

AES is a FIPS algorithm and has been for some time. NIST is in favor of it. Forgive me for being pedantic, but GCM is a mode -- and there are documents which I just found by typing "fips 140 modes of encryption" into a search engine, where it tells me that for AES:

AES-CCM is approved (SP800-38C), as is CMAC  (SP800-38B), and HMAC via FIPS 198-1 via SP800-107.

Note that also, they explicitly approve all of the SP800-38 sub documents, and that includes CBC with and without CTS, CCM, XTS, key wrap algorithms, and even format preserving encryption. There are a lot of other modes one could synthesize (like OCB and EAX) and they'd be fine. 

> 
>> And for what it's worth, I'm also against using GCM mode for storage encryption in particular, and thus in OpenPGP.
> 
> Noted. This is good to know.

In general, I think one should not be doing stream modes for storage, and the reason is nonce reuse. In the case of GHASH and thus GCM, the issue is that reusing a nonce breaks all MACs in the future and in the past. When one is doing streaming, breaking a past nonce isn't a big deal. However in storage, this is different. If someone accidentally reuses a nonce, the past break means that things already written can be undetectably modified. This is why the lot of us really, really get cranky about GCM. It would be much better to use CCM (because it was explicitly created to be a non-IP mode) or OCB (which is what we all want to use anyway, and it's faster than GCM). And yes, yes, there are also things like SIV.

I think that for storage of things like keys, it's better to do an HMAC or CMAC on top of CFB (since OpenPGP is full of that) or use CBC+CTS (which resolves padding issues).