Subject: Re: [Cfrg] PGP and non-malleability

From: [email-masked] (Peter Gutmann)
Date: Sat, 14 Dec 2002 17:47:25 +1300

Hugo Krawczyk <[email-masked]> writes:

>It is possible to do the processing with one pass over the data if you can
>wait to produce the PK encryption of the key and hash value AFTER this pas.

That's fixing the problem by redefining "one-pass" :-).

>In any case I'd like you to explain why this buffering or two passes are
>prohibitive in PGP. Is it because this changes the current processing order
>or is  there a more "essential" reason? (I do not see, in principle, why PGP
>couldn't work with buffered data).

You can't stream data if you need to do two passes.  Consider for example PGP-
encrypting a backup of your system with an 8GB hard drive and 128 MB system
memory.  The requirement to make multiple passes over the data was a
fundamental flaw in the PGP 2.x format that was fixed with OpenPGP, so this
would constitute a step backwards.

(Insert monthly "I really must get around to finishing off my crypto design
 considerations page at some point" comment here).

Peter.
_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: Hugo Krawczyk <[email-masked]>
Date: Sat, 14 Dec 2002 06:54:25 +0200 (IST)

> That's fixing the problem by redefining "one-pass" :-).

I suspected so :)

> would constitute a step backwards.

I can see that. The reason I asked is because it seemed to me that the 
motivation of Jon in raising this issue was applicable mainly to email
encryption where buffering sounds more reasonable.

Anyway, your objection seems very reasonable to me (especially that there
are as-secure methods that do not require the "two passes")

Hugo