The world is going to be locked into legacy CFB+MDC PGP pretty much indefinitely (because of the need to be compatible with an installed base which, owing to asynchronous messaging, can't be queried or negotiated with). As a result, to defend PGP as an ongoing practice, you're rhetorically required to argue that authenticated encryption --- not just modern AEAD, but the whole concept of authenticating ciphertext --- is overrated; 20 years of cryptographic research be damned.
Re:A New Future for GnuPG
by throw0101a on Tuesday January 04, 2022 @11:05PM
(#29805003)
As per the links I posted, drafts have been written acknowledging AEAD as something worth having, and code has been added to support those cipher modes. I don't think that anyone is is ignoring authenticating cipher text. But as you said, there's an installed base of, e.g., RHEL7, that cannot handle that. Some code does not churn as fast as semi-monthly web browser releases.
If you do not like PGP/GPG, you 'just' have to create a better way of doing things, and then 'just' have to convince everyone to switch their workflows to it.
For AEAD and OpenPGP, there seem to be limitations in the message format:
* https://datatracker.ietf.org/doc/html/draft-ford-openpgp-for...
Newer versions of GPG do support AEAD modes of operation, but AFAICT they only appear in the "encrypted data" part of the resulting bucket of data and not in the "signature" part. The algorithms are generally supported though; search for 'aead':
* https://www.gnupg.org/documentation/manuals/gnupg/OpenPGP-Op...
* https://www.gnupg.org/documentation/manuals/gcrypt/Available...