Re: [openpgp] Disadvantages of Salted Signatures

Andrew Gallagher <andrewg@andrewg.com> Mon, 11 December 2023 09:46 UTC

Return-Path: <andrewg@andrewg.com>
X-Original-To: openpgp@ietfa.amsl.com
Delivered-To: openpgp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A0ECC14F5F7 for <openpgp@ietfa.amsl.com>; Mon, 11 Dec 2023 01:46:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.107
X-Spam-Level:
X-Spam-Status: No, score=-7.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=andrewg.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id prAOaVPceDqx for <openpgp@ietfa.amsl.com>; Mon, 11 Dec 2023 01:46:43 -0800 (PST)
Received: from fum.andrewg.com (fum.andrewg.com [IPv6:2a01:4f9:c011:23ad::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 92CEAC14F5E2 for <openpgp@ietf.org>; Mon, 11 Dec 2023 01:46:42 -0800 (PST)
Received: from smtpclient.apple (serenity [IPv6:fc93:5820:7349:eda2:99a7::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by fum.andrewg.com (Postfix) with ESMTPSA id C13525ED7E; Mon, 11 Dec 2023 09:46:38 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=andrewg.com; s=andrewg-com; t=1702287998; bh=kDi/S5g78KnZs+z4wBvTJBICqcotmQKppLtIGiYxJyM=; h=From:Subject:Date:References:To:In-Reply-To:From; b=vapYDQ3IToUSBJOuEwJGh4reWIpqnb1VBnP9cvw5yV0d/+JxsFu7jJNzaYSG1V0Tv EBVf20Loqr/V/4JmVQ50t9WtfUdehCE62d06CqFieoVkU+8TbObzFxt22N6y0Rtxe5 UFb1F1M456FZqcqkEXpq7PT+d7UBAdNs4eHrJV/7D8oF2J7MllnNTtnbaqivCChEiq FD+G92S/7dzQ7wjy7yFFtzVIQLRkD6rnQgg8DfQuURw0R1GuoWFDH2bo0NaI4Jfvat ToDvu+fD5mWlXtr25PeUB/BgSfUDBPbQvCrO2gCFxjRSYSiXhSFVC/2KeHl3hfbEGO ZPxOfP4KLAK2w==
From: Andrew Gallagher <andrewg@andrewg.com>
Content-Type: multipart/signed; boundary="Apple-Mail=_CD34B3FA-A46C-4E57-B696-0A1DB057A978"; protocol="application/pgp-signature"; micalg="pgp-sha512"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.700.6\))
Date: Mon, 11 Dec 2023 09:46:21 +0000
References: <077dd27cef0c7d3968967fc4c3a880081b8bd9dd.camel@posteo.de> <8b5f251f-ae52-4937-9500-ddedb9fbef73@cs.tcd.ie> <709995498037ba59fb1a14d75ffa819702566d83.camel@posteo.de> <df7f0b41-f998-4f0e-b07e-67231031e54b@cs.tcd.ie> <a38abd9349683c1c0762daa8b203bc8578fc4853.camel@posteo.de>
To: Stephan Verbücheln <verbuecheln@posteo.de>, "openpgp\\\\@ietf.org" <openpgp@ietf.org>
In-Reply-To: <a38abd9349683c1c0762daa8b203bc8578fc4853.camel@posteo.de>
Message-Id: <EDD338F3-8942-45C2-B124-74156D66E036@andrewg.com>
X-Mailer: Apple Mail (2.3731.700.6)
Archived-At: <https://mailarchive.ietf.org/arch/msg/openpgp/w6ArHFvxLSMC1dg_MpCHfoMGCJg>
Subject: Re: [openpgp] Disadvantages of Salted Signatures
X-BeenThere: openpgp@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "Ongoing discussion of OpenPGP issues." <openpgp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/openpgp>, <mailto:openpgp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/openpgp/>
List-Post: <mailto:openpgp@ietf.org>
List-Help: <mailto:openpgp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/openpgp>, <mailto:openpgp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 11 Dec 2023 09:46:48 -0000

On 11 Dec 2023, at 07:37, Stephan Verbücheln <verbuecheln@posteo.de> wrote:
> 
> This change appears to be proposed by one party with one particular use
> case: Implementing PGP in JavaScript in the browser. This would explain
> the focus on fault attacks.

A nitpick, but there is more than just one party working on OpenPGP in the browser.

> This is also apparent for other changes of the refresh such as GCM
> (because better supported by browsers) and Argon2 (because storing
> millions of keys in the cloud with weak login passwords rather than
> strong encryption passphrases or smartcards). All at the cost of
> complexity and interoperability.

I do not understand the stated interoperability issue. OpenPGP ensures interoperability with optional features by requiring the end user to advertise their ability to handle them using flags on their public key; without those flags other implementations MUST NOT use optional features in their correspondence. This has been the case for almost three decades now, and it has worked remarkably well.

> One could even argue that this cloud use case beats the point of PGP
> and end-to-end encryption, which is to work with your private
> information in a trusted environment. The JavaScript engine of a web
> browser is not exactly that, especially for long-term keys.

We lost that war twenty years ago. An entire generation has grown up for whom webmail == email. A small working group revising a niche (sorry, everyone!) standard is not going to make a dent in that. Given that end-user adoption of OpenPGP is voluntary, the default alternative to OpenPGP-enabled webmail is plaintext webmail. You need to meet people where they are.

A