Re: [openpgp] Disadvantages of Salted Signatures

Andrew Gallagher <> Mon, 11 December 2023 09:46 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 2A0ECC14F5F7 for <>; Mon, 11 Dec 2023 01:46:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -7.107
X-Spam-Status: No, score=-7.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id prAOaVPceDqx for <>; Mon, 11 Dec 2023 01:46:43 -0800 (PST)
Received: from ( [IPv6:2a01:4f9:c011:23ad::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by (Postfix) with ESMTPS id 92CEAC14F5E2 for <>; Mon, 11 Dec 2023 01:46:42 -0800 (PST)
Received: from (serenity [IPv6:fc93:5820:7349:eda2:99a7::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPSA id C13525ED7E; Mon, 11 Dec 2023 09:46:38 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;; s=andrewg-com; t=1702287998; bh=kDi/S5g78KnZs+z4wBvTJBICqcotmQKppLtIGiYxJyM=; h=From:Subject:Date:References:To:In-Reply-To:From; b=vapYDQ3IToUSBJOuEwJGh4reWIpqnb1VBnP9cvw5yV0d/+JxsFu7jJNzaYSG1V0Tv EBVf20Loqr/V/4JmVQ50t9WtfUdehCE62d06CqFieoVkU+8TbObzFxt22N6y0Rtxe5 UFb1F1M456FZqcqkEXpq7PT+d7UBAdNs4eHrJV/7D8oF2J7MllnNTtnbaqivCChEiq FD+G92S/7dzQ7wjy7yFFtzVIQLRkD6rnQgg8DfQuURw0R1GuoWFDH2bo0NaI4Jfvat ToDvu+fD5mWlXtr25PeUB/BgSfUDBPbQvCrO2gCFxjRSYSiXhSFVC/2KeHl3hfbEGO ZPxOfP4KLAK2w==
From: Andrew Gallagher <>
Content-Type: multipart/signed; boundary="Apple-Mail=_CD34B3FA-A46C-4E57-B696-0A1DB057A978"; protocol="application/pgp-signature"; micalg="pgp-sha512"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.700.6\))
Date: Mon, 11 Dec 2023 09:46:21 +0000
References: <> <> <> <> <>
To: Stephan Verbücheln <>, "openpgp\\\\" <>
In-Reply-To: <>
Message-Id: <>
X-Mailer: Apple Mail (2.3731.700.6)
Archived-At: <>
Subject: Re: [openpgp] Disadvantages of Salted Signatures
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "Ongoing discussion of OpenPGP issues." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 11 Dec 2023 09:46:48 -0000

On 11 Dec 2023, at 07:37, Stephan Verbücheln <> wrote:
> This change appears to be proposed by one party with one particular use
> case: Implementing PGP in JavaScript in the browser. This would explain
> the focus on fault attacks.

A nitpick, but there is more than just one party working on OpenPGP in the browser.

> This is also apparent for other changes of the refresh such as GCM
> (because better supported by browsers) and Argon2 (because storing
> millions of keys in the cloud with weak login passwords rather than
> strong encryption passphrases or smartcards). All at the cost of
> complexity and interoperability.

I do not understand the stated interoperability issue. OpenPGP ensures interoperability with optional features by requiring the end user to advertise their ability to handle them using flags on their public key; without those flags other implementations MUST NOT use optional features in their correspondence. This has been the case for almost three decades now, and it has worked remarkably well.

> One could even argue that this cloud use case beats the point of PGP
> and end-to-end encryption, which is to work with your private
> information in a trusted environment. The JavaScript engine of a web
> browser is not exactly that, especially for long-term keys.

We lost that war twenty years ago. An entire generation has grown up for whom webmail == email. A small working group revising a niche (sorry, everyone!) standard is not going to make a dent in that. Given that end-user adoption of OpenPGP is voluntary, the default alternative to OpenPGP-enabled webmail is plaintext webmail. You need to meet people where they are.