Re: [openpgp] AEAD Chunk Size

Conrado P. L. Gouvêa <conradoplg@gmail.com> Tue, 02 April 2019 13:12 UTC

Return-Path: <conradoplg@gmail.com>
X-Original-To: openpgp@ietfa.amsl.com
Delivered-To: openpgp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 63DA512011F for <openpgp@ietfa.amsl.com>; Tue, 2 Apr 2019 06:12:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.02
X-Spam-Level:
X-Spam-Status: No, score=-1.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FROM_EXCESS_BASE64=0.979, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rq2cs83VDb8t for <openpgp@ietfa.amsl.com>; Tue, 2 Apr 2019 06:12:42 -0700 (PDT)
Received: from mail-yw1-xc36.google.com (mail-yw1-xc36.google.com [IPv6:2607:f8b0:4864:20::c36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC48012011A for <openpgp@ietf.org>; Tue, 2 Apr 2019 06:12:41 -0700 (PDT)
Received: by mail-yw1-xc36.google.com with SMTP id l5so4560821ywa.0 for <openpgp@ietf.org>; Tue, 02 Apr 2019 06:12:41 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=PWJJ8V34nuI+PuBZGN/qSgLlJI4FB4OzwnXSZjy4wlk=; b=JquBqZ/daBaXmJSHPm0rjHKOcG/ehT34rsNRw869v8PHCX97VULewj3vMrfiVhxqrW 7GDaD52rTUjUDPAz7+TySvJmLqIPuCGlU52UZ8evL9oxvMVmDlxb0VVmzESGznm71Kj8 ia3m1O3Q9ynd9f1ne2q4WNKNl+L1U2RIubCDgDcrps7GmMimXQd37OJK4Uojj5JqzM8W ygd7tMBuZkkvJwuPHtVyFK/UX7UoH6faMbkgdBltiky+1Yl2ge5a2LvGBzKJWLMO3eOq BvsKna0RN3N/M5vR9FmFJXwy26VSbosFysqfoOkbqCgJTcj/6mXUVJjsWWodpmIT/hQf NoDQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=PWJJ8V34nuI+PuBZGN/qSgLlJI4FB4OzwnXSZjy4wlk=; b=YKTFmGaSfjzjDmSrvcrhTFDUZJ/Cyf/jQPBYn8dWNBUV3nUpwow9cnGMX4btdJzhTh za/PgVOHCJVB1r3Svt7La3aaJtTz+HrKNfHo1KGlqa9OGisH98bh/bgxGcuuqO01CiDI vHfjdg+aN7Rsc+EkA/Lb2DkyBPUNQ4xmJBV7isR8xBBAu6DmR8hDjgJj6RyCH7fSWAoo C9ikPAOmSE9OM1TryrLaQ5y5Zx1aZfMYHrx2raGmYODHEzvB9lCnnvMXyxwRO+NuswBv F9FbCVKl9cumKbQb/5HXJtGsSAxieIXZ613UkhO5aEeJ56R+mXbhaIDrOSpe6u2STUlG dSSA==
X-Gm-Message-State: APjAAAXKuKC7P6RdAH+0bGlPCUPvThiErDBHctn7ENWyRFucDJveKfzi McUskdBAb3deLsacIctqJ3IOqZgqVwUmI/ZT3xg=
X-Google-Smtp-Source: APXvYqwoJzjjievLgPfeCgmcj0KbReBPSh14AoXmlv80dVHIIBfwxWypgS8OEx8l+YfrglQYDKJIt6y0R+9tCBJ3zuQ=
X-Received: by 2002:a0d:e403:: with SMTP id n3mr34002559ywe.408.1554210760922; Tue, 02 Apr 2019 06:12:40 -0700 (PDT)
MIME-Version: 1.0
References: <87mumh33nc.wl-neal@walfield.org> <878swzp4fb.fsf@europa.jade-hamburg.de> <E65F6E9D-8B0B-466D-936B-E8852F26E1FF@icloud.com> <87zhpd21d3.wl-neal@walfield.org> <D9D1ACD4-4944-495C-A058-1AA5D25FF8CF@icloud.com> <1554001112803.75759@cs.auckland.ac.nz>
In-Reply-To: <1554001112803.75759@cs.auckland.ac.nz>
From: =?UTF-8?B?Q29ucmFkbyBQLiBMLiBHb3V2w6ph?= <conradoplg@gmail.com>
Date: Tue, 2 Apr 2019 10:12:29 -0300
Message-ID: <CAHTptW_zrrSQtzyw5-_ThF9FqYE3hBzvSxDfKtvbZa0KaGW4-w@mail.gmail.com>
To: Peter Gutmann <pgut001@cs.auckland.ac.nz>
Cc: Jon Callas <joncallas@icloud.com>, "Neal H. Walfield" <neal@walfield.org>, "openpgp@ietf.org" <openpgp@ietf.org>, Justus Winter <justuswinter@gmail.com>, Jon Callas <joncallas=40icloud.com@dmarc.ietf.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/openpgp/z50iYnc6s4tM_EhgeTNkWJSi3AE>
Subject: Re: [openpgp] AEAD Chunk Size
X-BeenThere: openpgp@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Ongoing discussion of OpenPGP issues." <openpgp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/openpgp>, <mailto:openpgp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/openpgp/>
List-Post: <mailto:openpgp@ietf.org>
List-Help: <mailto:openpgp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/openpgp>, <mailto:openpgp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 02 Apr 2019 13:12:45 -0000

On Sat, Mar 30, 2019 at 11:59 PM Peter Gutmann
<pgut001@cs.auckland.ac.nz> wrote:
> I'm not saying remove it, just get some data to support making a decision in
> some way.  In particular, AEAD is a good thing, but there's no evidence that
> chunking with AEAD, which complicates things greatly, is useful or necessary.
>

I know you're tired of hearing about it... but EFail.
Even if PGP used AEAD, but without chunks, EFail would probably still
happen. If the AEAD data is arbitrarly large, then implementations
would be forced to provide a streaming API that discloses
unauthenticated plaintext, and the same thing would happen.

Unfortunately I'm not aware of other examples, though I'm pretty sure
they must exist... But why should we wait for more of this issues to
happen before fixing the underlying cause, if we can fix it now? (And
"now" meaning many years hence, since the standard will take a while
to be adopted).

Adam Langley has a good post about it:
https://www.imperialviolet.org/2014/06/27/streamingencryption.html
And many examples of cryptographers claiming releasing unauthenticated
plaintext is dangerous:
https://crypto.stackexchange.com/questions/41087/is-there-an-upper-limit-to-plaintext-size-in-xsalsa20poly1305/51439
https://crypto.stackexchange.com/questions/51537/delayed-tag-checks-in-aes-gcm-for-streaming-data

Conrado