Subject: Re: Sample Twofish message

From: [email-masked]
Date: Mon, 5 Apr 1999 13:44:40 -0700

Werner Koch, <[email-masked]>, writes:
>
> [email-masked] writes:
>
> > Note also that the special CFB "sync" operation (after processing these 10
> > bytes) is not to be done with block ciphers whose block size is greater
> > than 8 bytes, hence is not done for Twofish.
>
> Hmmm, section 5.7 states that encryption is done in PGP's special CFB
> mode and there is no exception mentioned.  
>
> If I remember correct, we discussed this 128 bit block cipher issue
> last year and changed the draft accordingly. 

The relevant paragraph from section 5.7 is:

   The data is encrypted in CFB mode, with a CFB shift size equal to the
   cipher's block size.  The Initial Vector (IV) is specified as all
   zeros.  Instead of using an IV, OpenPGP prefixes a 10-octet string to
   the data before it is encrypted.  The first eight octets are random,
   and the 9th and 10th octets are copies of the 7th and 8th octets,
   respectively. After encrypting the first 10 octets, the CFB state is
   resynchronized if the cipher block size is 8 octets or less.  The
   last 8 octets of ciphertext are passed through the cipher and the
   block boundary is reset.

It only resynchronizes the CFB state if the cipher block size is 8
octets or less.  Twofish has a block size of 16 octets, hence the CFB
state does not get resynchronized.

Hal

---

From: Werner Koch <[email-masked]>
Date: Tue, 6 Apr 1999 19:47:10 +0200

> The relevant paragraph from section 5.7 is:
[...] 
>    resynchronized if the cipher block size is 8 octets or less.  The
                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Ooops, I really missed that.  I only remembered from the discussion,
that we keep the special CFB mode.  

Many thanks - I hope I can decipher your mail in a few days.

  Werner

-- 
Werner Koch at guug.de           www.gnupg.org           keyid 621CC013

---

From: Jon Callas <[email-masked]>
Date: Wed, 07 Apr 1999 13:24:25 -0700

What about section 12.8 which says:

   Note that for an algorithm that has a larger block size than 64 bits,
   the equivalent function will be done with that entire block.  For
   example, a 16-octet block algorithm would operate on 16 octets, and
   then produce two octets of check, and then work on 16-octet blocks.

-----
Jon Callas                                  [email-masked]
CTO, Total Network Security                 3965 Freedom Circle
Network Associates, Inc.                    Santa Clara, CA 95054
(408) 346-5860                              
Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS)
              665B 797F 37D1 C240 53AC 6D87 3A60 4628           (RSA)

---

From: Werner Koch <[email-masked]>
Date: Thu, 8 Apr 1999 07:49:57 +0200

Okay, how can we resolve this conflict:

From section 5.7:
   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

From section 12.8:
   OpenPGP CFB mode uses an initialization vector (IV) of all zeros, and
   prefixes the plaintext with ten octets of random data, such that
   octets 9 and 10 match octets 7 and 8.  It does a CFB "resync" after
                                          ^^^^^^^^^^^^^^^^^^^^^
   encrypting those ten octets.

5.7 says that resync is only done for a blocksize <= 64 but 12.8 says
that is done always (the following step by step list also says this).

Please, can we agree on one version - I don't care which one, but it
is a bad idea to change this after the first message/secret-key has been
enciphered with a >64 bit blocksize cipher.  

We should agree on an interpretation of these questions:

 * Use resyncing at all for ciphers with a blocksize > 64 ?
 * Use it for encryption of secret key material in V3 packets ?
 * Use the blocksize or 64 bits for the CFB shift ?
 * Prepend 8+2 or blocksize+2 random bytes to the plaintext?
 * Keep the 8 byte salt for S2K modes?

---

From: [email-masked] (Lutz Donnerhacke)
Date: 8 Apr 1999 08:54:19 GMT

> * Use resyncing at all for ciphers with a blocksize > 64 ?

Use it if the processed cipher text is larger as the block size.
Do not concat ciphers of different message parts.

---

From: Uri Blumenthal <[email-masked]>
Date: Thu, 8 Apr 1999 21:17:36 -0400 (EDT)

>    resynchronized if the cipher block size is 8 octets or less.  The

1. For 128-bit block ciphers shouldn't the prefix be increased to,
   say, 18 bytes?

2. Shouldn't all procedures be adjusted to 16 octets for such ciphers?

> >From section 12.8:.........
> 

I'd abandon (or fix :-) 12.8.
-- 
Regards,
Uri		[email-masked]
-=-=-=-=-=-=-
<Disclaimer>