[openpgp] OpenPGP encryption block modes (Was: The Argon2 proposal seems incomplete (Draft 6))

[Bruce Walzer <[e-mail]>]

On Fri, Jul 29, 2022 at 02:54:27PM +0200, Werner Koch wrote:
> On Thu, 28 Jul 2022 19:35, Justus Winter said:
> > The current SEIPv1+MDC is impossible to implement securely.  Efail, one
> > of the best attacks on OpenPGP ever, is a direct consequence of that.
> 
> EFail has never been an attack on OpenPGP.  It is an attack on the
> majority of todays mail clients implementations.  We have seen other
> attacks which were more severe.
> 
> > whether a replacement for the SEIPv1+MDC system is needed.
> 
> CFB+MDC is a proper encryption system the we came up in 2000 with still
> no known attacks.  It is slow, though.  Thus a faster and easy to
> implement AE mode makes a lot of sense.  This is why we started to
> deploy OCB decryption capability years ago, so that in a few years it
> can replace the CFB+MDC mode.

Greater performance *is* a legitimate rationale for another block mode. I have been arguing that OpenPGP based systems have been implicitly depending on the inherent modification deterrence of SEIP to the extent that the MDC is mostly ignored. Because of that I have to admit that OCB has much better inherent modification detection. Modifications on OCB damage the block modified, not the next one as with SEIP. So if we had to have another block mode (I am still not convinced of this) then OCB would seem a particularly rational choice.

> 
> The whole new complex "crypto-refresh" AE stuff to support the brittle
> GCM is a dead end.  Well, unless you want to put OpenPGP back into the
> geek-only domain.

I think the problem of extraneous block modes like GCM came from the
decision to start calling the block mode "AEAD". Once there was an
apparent slot opened up with that name only then did people start
thinking of things to drop into that slot. So GCM could be seen as an
example of an inappropriate graft from another regulatory medium based
on confusion of terminology.

AEAD isn't even a very accurate term in an OpenPGP context. There is
no AD (associated data) exposed to the user of such a system. It just
doesn't work that way.

Bruce