Re: Encryption and authentication

On Fri, Jun 23 2023, Denis Corbin wrote:

> On 23/06/2023 05:44, John Goerzen wrote:
>> Anyhow, in researching the encryption and signature options, I believe
>> that what I have found it this:
>> - The encryption itself is not authenticated (not using AEAD or some
>>    such)
>
> correct
>
>> - The signature applies only to the session key
>
> "session" usually means a set of events linked together over time (start
> session, do transactions in that session, end a session). Not sure this concept
> of session applies to dar/libdar but:

Here I meant the random key used for symmetric encryption, generated in
the case of the user requesting public-key encryption.

> you can have more info about the way strong encryption is used in libdar here:
>
> http://dar.linux.free.fr/doc/Notes.html#strong_encryption
>
>
>> - (And the key seems to be derived using SHA-1; not sure how important
>>    that is)
>
> this is not exact: actually if libargon2 is available the key derivation
> function is argon2 protocol with salt (see --kdf option)
>
>> So it looks to me that --sign doesn't actually guarantee the integrity
>> of the data.
>
> No, it should. There is just one known restriction when signing an archive for
> multiple recipients as documented here:

So I'm trying to reason about how it would, since the underlying data is
not signed.

In the notes URL, I see that actually two things are signed: the
encryption key, and the sha512 of the catalog.  So now, assuming the CRC
stored in the catalog is always validated, a person couldn't get away
with modifying the data stream unless they are also able to produce a
matching CRC.  I don't know the difficulty of doing this when encryption
is concerned, but I know CRC itself isn't considered a
cryptographically-secure algorithm these day.

Another thing I notice - there isn't a way to tell dar to /require/
verification of a signature.  A person could just flip the flag in the
version trailer to indicate no signature (and, perhaps, also remove the
signature) and then it would extract without error, right?

Thanks again,

John