[openpgp] Re: on the risks of AEAD as signature [was: Re : draft-ietf-openpgp-persistent-symmetric-keys-02.txt]

On 10/11/2025 13:52, Daniel Huigens wrote:
> The reason we added an HKDF step for AEAD in SEIPDv2 and S2K usage
> octet 253 was to thwart cross-AEAD-mode attacks, not key commitment.

Right, I thought we also got key commitment as a side effect, but after 
doing the maths it seems any protection given is minimal.

The HKDF output is shared between the message key and the IV, so if you 
generate two message keys via HKDF you also get two different IVs, and 
the attack described relies upon the IV/nonce being the same between 
both ciphertexts. To make the salamander attack work in practice you 
need two different message keys with the same IV, therefore you need to 
find two HKDF outputs with N-64 colliding bits in the appropriate 
place... so at first glance that's good.

But. GCM uses a 12-octet nonce (i.e N=96), leaving only 32 bits in the 
IV - which is practically nothing, equivalent to colliding a short 
keyID. Yikes.

A

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]