Re: [openpgp] Replacing the OpenPGP Encryption Mode is Harmful and Pointless

[Daniel Huigens <[e-mail]>]

On Friday, July 15th, 2022 at 21:27, Bruce Walzer <[e-mail]> wrote:

> If the error is in the spec, then I, as the application programmer,
> have to deal with it somehow. So I can't get around having to decide
> what to provide the user instead of the message they are expecting.

Sure. My argument is that you can safely decide not to provide anything
in this case, because in practice, this situation won't occur.

> Why would the application programmer perfer having to dechunk the
> message?

The application programmer doesn't have to do that. The OpenPGP library
can do so. The advantage for the application programmer is that they
get data sooner (when streaming) when the library does this check.

> I don't understand how this relates to anything I said in the article.

In your article, you proposed using signatures to fix EFAIL. I pointed
out that this is mixing up responsibilities.

> I was not suggesting that anonymous/unsigned messages should be
> withheld, only modified.

The point still stands, using signatures to fix EFAIL is impractical and
inefficient. Also, I think modifying unsigned messages would cause much
worse UX.

> Are we implying here that OCFB-MDC is inefficient?

Yes, AEAD is more efficient than OCFB-MDC in both our implementations.
OCB, for example, is a single-pass algorithm, which means it looks at
the data only once, while OCFB-MDC has to go over the data twice.

> At some point experience has to trump analysis. If 20 years
> is not enough then how long would it take?

Why do you think that a scheme not being broken in the past 20 years
means that it won't be broken in the coming 20 years? In any case, OCB
is also 10 years old at this point, if you value that more. Combined
with a security proof (based on some reasonable assumptions), to me it
inspires more confidence than OCFB-MDC.

Best,
Daniel