[openpgp] Re: on the risks of AEAD as signature [was: Re : draft-ietf-openpgp-persistent-symmetric-keys-02.txt]

On Monday, November 10th, 2025 at 15:46, Simo Sorce wrote:

> This limit exist because nonce-reuse is catastrophic, and given you
> have 2^64 bytes per message the birthday paradox forces this small
> limit. Using AES-GCM with a fixed key is extremely tricky if you can't
> ensure that nonces are never reused, it should definitely not be done.

FWIW, we're encrypting session keys here (or even the empty message in
the MAC case) so never 2^64 bytes, but the point about avoiding nonce
reuse stands.

> A potential alternative is to standardize the use of AES-GCM-SIV.
> It is slower on encryption, but that shouldn't be a huge issue for
> openpgp.

I think adding AES-GCM-SIV is out of scope for this draft, but could be
considered separately.

> Key derivation in these cases is always a very good practice, and
> should always be done unless there is a compelling reason not to.

Noted, thanks! There's of course a small performance hit but I don't
think it's super critical either.

Best,
Daniel

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]