Subject: [Openpgp-dt] Version 2 Sym. Encrypted Integrity Protected Data Packet Format

From: NIIBE Yutaka <[email-masked]>
Date: Mon, 28 Feb 2022 12:25:50 +0900

Hello, again,

Thank you for the test vectors.  Next attempt of mine is v2 SEIPD, and I
confirmed my imprementation works with the test vectors of EAX and OCB.
(I don't yet have GCM.)

During reading the spec., I noticed two things.

* It would be better to have a field for HKDF hash algo (in v2 SEIPD
  packet).

  - Currently, the crypto-refresh.md uses fixed hash algo of SHA256.

  - I wonder if someone wants to use different hash algo for larger
    cipher key.

    - We should note that, TLS 1.3 has TLS_AES_256_GCM_SHA384, which
      uses SHA384 for such an hkdf with AES256.

* The construction of nonce looks not good for me.

  - Currently, the crypto-refresh.md uses:

    The left-most N - 64 bits are the initialization vector derived using HKDF.
    The right-most 64 bits are the chunk index as big-endian value.

  - In TLS 1.2, it uses RFC5116 method;
    nonce: composed by random part + counter part.
    addtional data: composed by counter + something.

  - In TLS 1.3, 
    nonce: XORed with random part and counter.
    addtional data: with no counter.

  - I think not including counter in additional data is good.

  - I wonder why not use XORed nonce (given the use of HKDF, which can
    generate more, easily)?
--