Subject: [Openpgp-dt] ECDH KDF uses only the first 20 octets of the v5 fingerprint

From: Daniel Kahn Gillmor <[email-masked]>
Date: Mon, 13 Dec 2021 13:24:06 +0200

Hi OpenPGP DT:

While writing a draft of proposed security considerations about
fingerprint usability, i wanted to state that the spec always uses the
full fingerprint for v5 keys, as i think that reflects the consensus of
the design team from a few meetings ago.

However, i note that the ECDH KDF params use only the first 20 octets of
the fingerprint of a V5 key.  This isn't "on the wire" (because the KDF
params are computed but not explicitly relayed), but it is still a
place where the spec doesn't use the full fingerprint.

If there is a cryptographic reason for this truncation, i don't know
what it is. Maybe we should just use the full fingerprint here as well?

If the answer is "we are fine with this" that's also ok, i just want to
make sure that the DT is making this choice explicitly.  I've opened MR
!105 as a proposal if we want to use the full v5 fpr here for
consistency -- please give it a thumbs down (with an explanation) if you
think that's a bad idea.

I'm proposing this because we seem to be open to re-thinking how to
structure key schedules and things in the AEAD portion of the spec
(e.g. MR !101), so i thought we might want to also consider this part of
the key derivation schedule.

     --dkg

PS i've opened this issue as
https://gitlab.com/openpgp-wg/rfc4880bis/-/issues/65 to track it.