[openpgp] Re: on the risks of AEAD as signature

Hi Falko--

Thanks for nudging this conversation in a more concrete direction:

On Mon 2025-11-10 08:52:04 +0100, Falko Strenzke wrote:
> The main question is who is going to forge an AEAD message to fool whom. 
> For the verification of a MAC or AEAD protected message the secret key 
> is needed. Obviously, with the possession of the secret key, signature 
> forgeries can be performed. I suggest to first consider whether there is 
> a valid attack scenario here in the first place.

I expect a symmetric signature to be used to record something that would
otherwise be more expensive to recompute, like an asymmetric signature
verification.

So for example:

- Bob might send Alice a message X, signed using Bob's secret key b
  (with corresponding certificate B), via a signature B_X.

- Alice verifies the signature B_X over X with certificate B, and caches
  the result by appending her own symmetric signature A_X to the message.
  She uses symmetric secret key A (known only to her).

The rationale here would be if it's cheaper for Alice to verify <X,A_X>
than to recompute Verify(X,B_X).  Alternately, A_X might be smaller/more
compact than B_X, so maybe Alice wants to conserve storage by replacing
B_X with A_X.

The security "game" here might be for Bob (who controls the creation of
X and B_X and might be able to see A_X) (or another attacker, who might
at least know X, B_X, and A_X) to be able to produce a variant X' that
*also* validates against A_X.  If the attacker can do that, then Alice's
signature cache actually introduces a security flaw, because Bob doesn't
have to make a non-repudiable assertion in order for Alice to believe
that he had signed the message.

I'm not claiming i know of a functional attack in such a game.  I'm just
observing that the existence of the "invisible salamanders" attack
suggests that at least GCM AEAD doesn't provide the security one might
expect from a message signature or even a checksum.

I'd be very happy to see analysis that suggests this is not an issue.

    --dkg

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]

-----BEGIN PGP SIGNATURE-----

wr0EARYKAG8FgmkSNXQJEHgLhU7ZwrSWRxQAAAAAAB4AIHNhbHRAbm90YXRpb25z
LnNlcXVvaWEtcGdwLm9yZ7v5KqGJC1VuJ+pAJhRku3I+00YDYLA/Y9MKc1bpEfaO
FiEEY6wRjlsuXWbIioWneAuFTtnCtJYAAJsZAQDeg081wY1+tqEGmLeKR+sUpj69
zXP4zMMADTkU/5HGzgD+L4RIwBkK+ii5C+Mt42X48aKXnw9zELYFDinqGlBnvAQ=
=xHOg
-----END PGP SIGNATURE-----