[openpgp] Re: Deterministic generation of (symmetric) public key params from private key params

[Justus Winter <[e-mail]>]

Hi Daniel :)

Daniel Huigens <d.huigens=[e-mail]> writes:

> On Wednesday, November 13th, 2024 at 15:03, Justus Winter wrote:
>> I don't understand the motivation for the hash seed in the first place.
>> Why not derive a mock public key from the secret key, i.e. include
>> SHA2-256(persistent symmetric key material) in the algorithm-specific
>> bits of the public key packet?
>
> I'm not 100% sure this is safe in all scenarios. For an AES-256 key it
> probably is, but for an AES-128 key, due to the birthday paradox, after
> "only" 2^64 keys there's a ~50% chance that two people will share a key.
>
> If the encrypted private keys are stored on a server, like Proton does,
> then the server can find out which two users share a private key by
> looking at the public key material; and ask one user to decrypt a
> message of the other user, for example. That seems bad.
>
> We could say that persistent symmetric keys may only be used with >=256
> bit keys, but having a separate hash seed just seemed simpler and easier
> to reason about.

Interesting.  What about also hashing in the other metadata (i.e. the
timestamp).  Then, the problem arises only if you have 2^64 users
creating a symmetric key at the exact same time

Best,
Justus