[openpgp] Re: I-D Action: draft-ietf-openpgp-persistent-sy mmetric-keys-02.txt

On Wednesday, November 5th, 2025 at 13:49, Andrew Gallagher <[email protected]> wrote:

> OK, I think we're closer to agreement than it may seem then. ;-) If we
> think AEAD is sufficiently flexible for the foreseeable future, and we
> will have to bump packet version numbers anyway if/when we deprecate it,
> then it might be reasonable to register "0 means PSK" without any
> further explanation in the asymmetric algorithms registry, and hardcode
> AEAD in the specification of "PSK version 6", without a new registry.

Yes, makes sense :)
This by itself doesn't fully specify what a PKESK and Signature packet
with algorithm ID 0 means, and having it in the table could be nice,
but we could also just put it in the text of course, indeed.

> I think the only other major concern would be whether there is
> sufficient protection against cross-algorithm attacks in signatures,
> given that there is no field for the AEAD algorithm code point (unlike
> SEIPDv2). Would it be sufficient to encrypt an algorithm-dependent
> constant string instead of a null string?

The key material includes the AEAD algorithm ID, which is in turn fed
into the fingerprint, which SHOULD end up in the hashed data of the
signature, according to section 5.2.3.35 of RFC9580. We could strengthen
that to a MUST for persistent symmetric signatures, to ensure a strong
binding to the algorithm ID, perhaps.

Alternatively/additionally, we could add it into the additional data
passed to the AEAD mode. That does essentially the same thing as
encrypting an algorithm-specific value, but without adding the
overhead of the ciphertext.

Best,
Daniel

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]