Subject: [openpgp] draft minutes for ietf113 openpgp session

From: Stephen Farrell <[email-masked]>
Date: Mon, 28 Mar 2022 13:35:07 +0100

Hi all,

Thanks again to Aron and Florence for taking good notes.
Our draft minutes for the session are at [1]. Please
send any corrections/clarifications/additions to the list
and/or chairs in the next week or so.

Cheers,
Stephen.

[1] 
https://datatracker.ietf.org/meeting/113/materials/minutes-113-openpgp-00

---

From: Justus Winter <[email-masked]>
Date: Mon, 28 Mar 2022 15:10:35 +0200

> and/or chairs in the next week or so.

] Discussion:
] * Werner Koch (WK) dropped out of DT in summer, stating the critical questions were already done. Still, since then there are large changes from then. AEAD started being deployed 4y ago, and is now being reworked already. The old AEAD packets were deprecated and new packets were added. Also doesn't think that adding a new KDF is a good idea, it adds complexity.
] * Daniel Huigens (DH): AEAD was changed because of a downgrade attack designed from Lara Bruseghini, converting GCM to CFB if the MDC is broken, leading to a decryption oracle. Therefore we added key separation. There are other possibilities, but changes were needed.

I don't think the attack was designed by Lara, AIUI she dug it up.

] * WK: Better option is to only allow one mode of operation, which should be OCB. Rather add an optional GCM packet rather than deprecating the old one.
] * Daniel Kahn Gillmor (DKG): Less is better, but changing the mode to OCB only is a major change already.
] * WK: Users should have choice of algorithm but not mode.
] * Paul Wouters (PW): This is an argument for discussion before we make a PR.
] * Justus Winter (JW): check with Werner to define a more precise proposal and discuss this on the mailing list.

That was someone else, I don't remember who though.

Justus

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 28 Mar 2022 15:14:38 +0100

Hiya,

Thanks. I made the changes below.

On 28/03/2022 14:10, Justus Winter wrote:
>> Thanks again to Aron and Florence for taking good notes. Our draft
>> minutes for the session are at [1]. Please send any
>> corrections/clarifications/additions to the list and/or chairs in
>> the next week or so.
> 
> ] Discussion: ] * Werner Koch (WK) dropped out of DT in summer,
> stating the critical questions were already done. Still, since then
> there are large changes from then. AEAD started being deployed 4y
> ago, and is now being reworked already. The old AEAD packets were
> deprecated and new packets were added. Also doesn't think that adding
> a new KDF is a good idea, it adds complexity. ] * Daniel Huigens
> (DH): AEAD was changed because of a downgrade attack designed from
> Lara Bruseghini, converting GCM to CFB if the MDC is broken, leading
> to a decryption oracle. Therefore we added key separation. There are
> other possibilities, but changes were needed.
> 

I did s/designed from/notified by/

> 
> ] * WK: Better option is to only allow one mode of operation, which
> should be OCB. Rather add an optional GCM packet rather than
> deprecating the old one. ] * Daniel Kahn Gillmor (DKG): Less is
> better, but changing the mode to OCB only is a major change already. 
> ] * WK: Users should have choice of algorithm but not mode. ] * Paul
> Wouters (PW): This is an argument for discussion before we make a
> PR. ] * Justus Winter (JW): check with Werner to define a more
> precise proposal and discuss this on the mailing list.
> 

Yeah, I think that was me saying I'd chat with Werner before
starting the thread on the WG list (to try ensure I don't get
it too badly wrong:-)

Cheers,
S.

---

From: Werner Koch <[email-masked]>
Date: Tue, 29 Mar 2022 14:24:57 +0200

> I don't think the attack was designed by Lara, AIUI she dug it up.

She is the author of the the yet unpublished paper.  I known the draft
for a year or so and only recently asked her whether it has been
published.

Shalom-Salam,

   Werner

-- 
The pioneers of a warless world are the youth that
refuse military service.             - A. Einstein

---

From: Justus Winter <[email-masked]>
Date: Tue, 29 Mar 2022 14:46:23 +0200

Werner Koch <[email-masked]> writes:

> She is the author of the the yet unpublished paper.

But the notes talk about a different paper that describes how to
downgrade a GCM cipher stream to CBC thereby stripping the
authentication and making it malleable again:

  https://www.ndss-symposium.org/wp-content/uploads/2017/09/10_4_0.pdf

Justus