Re: [openpgp] Replacing the OpenPGP Encryption Mode is Harmful and Pointless

Hi,

I won't attempt to address the entire article but I want to bring up
some points:

> The email client application code receives this error instead of the
> decrypted message. Now what? What do we tell the user?

It's a good question, but I think it's important to note that the goal
of security checks, in general, is to prevent an attack, and so
actually the hope is that the error *won't* be shown. If the check is
there, there's no reason to do the attack, and thus the error should
only show up if there's some bug, which should be caught quickly thanks
to the check. So I think that errors being bad UX is not a sufficient
argument not to have the check (you also have to somehow argue why the
errors would show up at all).

Then, if you (somewhat) agree with that, I want to bring up a practical
advantage of the new scheme: it breaks up messages into chunks, which
can be checked and released to the application individually, instead of
having to wait for the MDC at the end of the message.

> The user already knows about email signatures, so why not try an
> approach based on, you know, authenticity?

EFAIL is an attack against confidentiality, not just authenticity.
That's why it should be fixed at the encryption layer, imo. You might
also not have the public key of the sender, and requiring that just to
be able to safely decrypt the message would make things much worse.
(Additionally, if you wanted to break up the message into chunks, as we
do with AEAD, and sign each chunk, that would become very expensive.)

Then, you might still ask, why use AEAD instead of OCFB-MDC.
A proper AEAD scheme integrates confidentiality and integrity, which
makes providing both more efficient and more secure. If you want proof
of that, you should ask a cryptographer instead of me, but a security
proof is typically included with the paper of any good AEAD scheme. A
security proof for OCFB-MDC doesn't exist, as far as I know, and it's
doubtful whether it's possible to provide one, which in itself should
be worrying, even if nobody has been able to come up with a practical
attack (so far).

Best,
Daniel

------- Original Message -------
On Friday, July 15th, 2022 at 13:11, Bruce Walzer <bwalzer@59.ca> wrote:

> The article in question:
>
> * https://articles.59.ca/doku.php?id=pgpfan:no_new_ae
>
> This editorial fell out of a series of OpenPGP advocacy articles I wrote. The position:
>
> * The current OpenPGP encryption mode is secure and appropriate and
> should not be replaced.
>
> * The OpenPGP standard should not suggest or attempt to mandate that
> data that is suspected of malicious modification should be withheld
> from any entity. It is better to complete the operation and then
> provide the status.
>
> I realize that this is not at all a mainstream position to take. I am
> only posting this here in case it gains any traction. I don't want to
> blindside anyone.
>
> Bruce
>
> _______________________________________________
> openpgp mailing list
> openpgp@ietf.org
> https://www.ietf.org/mailman/listinfo/openpgp