Subject: [Openpgp-dt] OCB nonce size

From: Paul Wouters <[email-masked]>
Date: Wed, 23 Feb 2022 17:06:48 -0500 (EST)

I heard back from Ted:

 	During the RFC review process some people reviewing the draft were
 	concerned about the variable length nonce ability in OCB. At that time
 	we co-opted the high byte of Nonce to indicate the length of nonce being
 	used. Prior to that point in time the nonce was free to be up to 127
 	bits. The FAQ was likely never updated. So, the RFC version of OCB does
 	have a max nonce length of 120 bits = 15 octets.

 	A 12 byte nonce recommendation is purely to align with RFC 5116, but
 	any length nonce will do as long as a nonce never repeats for the same key

I think it makes sense for openpgp to also align with RFC 5116 to ensure
the crypto libraries have the support needed for OCB with OpenPGP.

Paul

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Thu, 24 Feb 2022 01:57:04 -0500

> the crypto libraries have the support needed for OCB with OpenPGP.

I think this is saying that you support 96-bit nonces.  I've noted over
on https://gitlab.com/openpgp-wg/rfc4880bis/-/issues/83 that the latest
version of Python's cryptography module (version 36.0) only supports
96-bit nonces in OCB, though that doesn't seem to be a requirement from
their OpenSSL backend.  I raised the issue with cryptography upstream
and @reaperhulk pointed out that the OCB RFC only has test vectors for
96-bit nonces.  (see https://github.com/pyca/cryptography/issues/6894)

Maybe we could collect a list of problematic OCB APIs in the comments on
#83 ?  I've only done a sort of spot check, not an exhaustive survey.

    --dkg

---

From: Paul Wouters <[email-masked]>
Date: Thu, 24 Feb 2022 09:04:17 -0500 (EST)

On Thu, 24 Feb 2022, Daniel Kahn Gillmor wrote:

[ Yes, Ted was Ted Krovetz ]

> I think this is saying that you support 96-bit nonces.

Yes.

> I've noted over

Likely for the same reason, that IETF only wanted a fixed nonce size.

> #83 ?  I've only done a sort of spot check, not an exhaustive survey.

I wouldn't call it "problematic" ?

I think our findings are enough to justify sticking with a fixed size
96 bit nonce.

Paul