[openpgp] Re: on the risks of AEAD as signature [was: Re : draft-ietf-openpgp-persistent-symmetric-keys-02.txt]

I don't see how the HKDF key derivation plays a role here.

But more importantly, I don't understand the attacks being discussed. 
First of all, I suggest to drop the word signature here because it 
simply doesn't correctly address what is being proposed. MACs or AEAD 
tags are not equivalent to public-key signatures regarding the achieved 
security notions.

The main question is who is going to forge an AEAD message to fool whom. 
For the verification of a MAC or AEAD protected message the secret key 
is needed. Obviously, with the possession of the secret key, signature 
forgeries can be performed. I suggest to first consider whether there is 
a valid attack scenario here in the first place.

Falko


Am 07.11.25 um 19:16 schrieb Andrew Gallagher:
> On 07/11/2025 00:22, Daniel Kahn Gillmor wrote:
>>
>> Thanks for this note.  I'm not enough of a cryptographer to understand
>> the risks clearly here, but my loose understanding of the "invisible
>> salamanders" paper suggested that it's possible to create two messages
>> that would have a colliding AEAD tag (maybe under different keys?):
>>
>> https://eprint.iacr.org/2019/016
>>
>> That is, it describes GCM as a "non-committing AE" scheme, and indicates
>> that a modified primitive is necessary to make it "committing". Is this
>> sufficient to behave as a signature for our purposes?
>
> Isn't this why we specified an HKDF step in SEIPDv2? We could do the 
> same thing here.
>
> A
>
> _______________________________________________
> openpgp mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
-- 

*MTG AG*
Dr. Falko Strenzke

Phone: +49 6151 8000 24
E-Mail: [email protected]
Web: mtg.de <https://www.mtg.de>

------------------------------------------------------------------------

MTG AG - Dolivostr. 11 - 64293 Darmstadt, Germany
Commercial register: HRB 8901
Register Court: Amtsgericht Darmstadt
Management Board: Jürgen Ruf (CEO), Tamer Kemeröz
Chairman of the Supervisory Board: Dr. Thomas Milde

This email may contain confidential and/or privileged information. If 
you are not the correct recipient or have received this email in error,
please inform the sender immediately and delete this email.Unauthorised 
copying or distribution of this email is not permitted.

Data protection information: Privacy policy 
<https://www.mtg.de/en/privacy-policy>

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]