EFail – Vulnerabilities in end-to-end encryption technologies OpenPGP and S/MIME

Re:EFail – Vulnerabilities in end-to-end encryption technolo... by shinigami on Tuesday May 15, 2018 @07:11AM (#17073098)

AEAD is not enough. How do you decrypt/verify a 100 GB file with AEAD, without disclosing unauthenticated plaintext in a single pass? You need streaming AEAD like STREAM or CHAIN.

[ Parent | on HN ]

Re:EFail – Vulnerabilities in end-to-end encryption technolo... by cyphar on Tuesday May 15, 2018 @07:43AM (#17073223)

Doesn't OCB allow you to stream and verify in a single-pass (because the MAC is embedded in the 128-bit blocks of the underlying cipher blocks)?

[ Parent | on HN ]

Re:EFail – Vulnerabilities in end-to-end encryption technolo... by shinigami on Wednesday May 16, 2018 @08:57AM (#17081982)

I'm not sure I understand. In OCB (or any other AEAD) there is a single MAC for the entire ciphertext. You can't decrypt&verify large data in a single pass.

[ Parent | on HN ]

Re:EFail – Vulnerabilities in end-to-end encryption technolo... by cyphar on Wednesday May 16, 2018 @10:43AM (#17082774)

You are completely right that for some constructions (such as ChaCha20-Poly1305, AES-CCM, and possible AES-GCM) there is only a single MAC for the entire ciphertext.

However that is not true for other constructions. AES-OCB is a single-pass cipher that has a MAC for each block (this is actually the main selling feature of OCB). (AES-EAX also has a MAC for each block too, but is two-pass.)

Also, STREAM/CHAIN are also AEAD, so your generalisation can't be always true.

[ Parent | on HN ]

Re:EFail – Vulnerabilities in end-to-end encryption technolo... by shinigami on Thursday May 17, 2018 @08:11AM (#17090620)

I don't see it. From https://www.rfc-editor.org/rfc/rfc7253.txt :

Function name: OCB-ENCRYPT Input: K, string of KEYLEN bits // Key N, string of no more than 120 bits // Nonce A, string of any length // Associated data P, string of any length // Plaintext Output: C, string of length bitlen(P) + TAGLEN bits // Ciphertext

Only a single tag, exactly like CCM and GCM. Am I missing something?

It depends on what you call "AEAD", of course. For me it's something that generates a single MAC. STREAM/CHAIN can then be used with an underlying AEAD (GCM, CCM, OCB, SIV) to create a "streaming AEAD" that generates multiple chunks, each one of them with a MAC.

[ Parent | on HN ]

Re:EFail – Vulnerabilities in end-to-end encryption technolo... by cyphar on Thursday May 17, 2018 @09:12PM (#17097825)

I'll be honest, I was going off the Wikipedia description of the algorithm.

But looking at the RFC you're right that there's only one authentication tag (I also looked at the GPG implementation as well as the proposed OpenPGP RFC for AEAD -- and it looks like they implement chunking on top of OCB/EAX/GCM for this reason). I stand corrected.

[ Parent | on HN ]