Subject: [Openpgp-dt] Combinations of AEAD modes and symmetric ciphers

From: Daniel Kahn Gillmor <[email-masked]>
Date: Thu, 24 Feb 2022 02:11:40 -0500

[ I've noted this concern as
https://gitlab.com/openpgp-wg/rfc4880bis/-/issues/94 ]

Some crypto backend libraries only support certain AEAD modes with
certain block ciphers.

For example, OpenSSL has EVP_aes_256_ocb but it does not have a
comparable EVP_bf_ocb (for blowfish) or EVP_camellia_256_ocb (for
Camellia).

But the current draft signals support for ciphers orthogonally from AEAD
modes. There's no way for a certificate to indicate "i can do either OCB
or GCM with AES256, and i can do GCM with Camellia, but i cannot do OCB
with Camellia".

This smells like a recipe for interop failure to me.  I've proposed an
alternate signalling mechanism: changing the "Preferred AEAD Algorithms"
subpacket to be a list of (symmetric-cipher,aead-mode) pairs of octets,
and ret-conning the Symmetric Algorithm Preferences subpacket to be
Symmetric Algorithm Preferences for SEIPDv1.

I'm not sure i like the proposal (and i haven't written it up formally),
but i'd really appreciate it if folks would take a look at it.  Maybe
it's not actually necessary for some reason i don't understand yet.

    --dkg