<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>[re-sent to list]<br>
</p>
<div class="moz-cite-prefix">Am 18.09.24 um 10:07 schrieb Falko
Strenzke:<br>
</div>
<blockquote type="cite"
cite="mid:f133d66d-97c0-4ed2-8eaf-514e30c791f2@mtg.de">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div class="moz-cite-prefix">Hi Werner,</div>
<div class="moz-cite-prefix"></div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Am 13.09.24 um 14:40 schrieb Werner
Koch:<br>
</div>
<blockquote type="cite" cite="mid:87frq37mm1.fsf@jacob.g10code.de">
<pre wrap="" class="moz-quote-pre">Hi,
and thanks for looking at the specs.
On Tue, 10 Sep 2024 09:56, Falko Strenzke said:
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">says that "the initialization vector per message MUST be distinct" for
OCB. Distinctness is not sufficient here, since the per-chunk nonce is
derived by XORing the IV with the chunk index. Thus, for messages with
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">Right. A simple fix might be to write
"the initialization vector and thus derived nonces MUST be distinct per
message chunk"</pre>
</blockquote>
Yes, that is the effective requirement. But it leaves open how the
sender should know the nonces used in previous encryption
processes for the same key. That might actually be OK, since all
this happens under the premise of session key reuse, which is not
the normal case (as stated under <a
href="https://www.ietf.org/archive/id/draft-koch-librepgp-02.html#name-confidentiality-via-encrypt"
moz-do-not-send="true">2.1. Confidentiality via Encryption</a>,
a new session key should be created for each message). Thus
session key reuse is a special case the exact circumstances of
which must remain open in the spec, and it seems valid to leave it
to the implementer how to achieve distinct nonces per chunk.<br>
<blockquote type="cite" cite="mid:87frq37mm1.fsf@jacob.g10code.de">
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">Accordingly, random IVs are required here. After this correction, it
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">Well, that is the easiest solution and given that an RNG is anyway
required most likely that what everyone will do.
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">considerations regarding the number of repeated messages under the
same key using random IVs and the resulting nonce-collision
probabilities.
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">That is hard to describe because it depends on the size of the chunks
and the message. In this regard a mimimal but large chunk size would be
better. But we better don't open that issue again.</pre>
</blockquote>
<p>Maybe it is also fine to leave the math to an implementer who
want to use session key reuse in the first place.</p>
<p>Best regards,<br>
Falko<br>
</p>
<blockquote type="cite" cite="mid:87frq37mm1.fsf@jacob.g10code.de">
<pre wrap="" class="moz-quote-pre">Salam-Shalom,
Werner
</pre>
</blockquote>
<div class="moz-signature">-- <br>
<!-- MTG AG HTML signature v.1.0, 2021-02-12 - Author: Andreas Cholet -->
<div style="font-family: Arial,serif">
<p
style="line-height: 1.5; font-size: small; color: rgb(93, 93, 95);"> <strong>MTG
AG</strong><br>
Dr. Falko Strenzke <br>
</p>
<p style="font-size: small; color: rgb(93, 93, 95);"> <span
style="display:inline-block;width:4em">Phone: </span>+49
6151 8000 24<br>
<span style="display:inline-block;width:4em">E-Mail: </span><a
class="moz-txt-link-abbreviated moz-txt-link-freetext"
href="mailto:falko.strenzke@mtg.de" moz-do-not-send="true">falko.strenzke@mtg.de</a><br>
<span style="display:inline-block;width:4em">Web: </span><a
href="https://www.mtg.de" title="MTG AG Internet"
target="_blank" moz-do-not-send="true">mtg.de</a> </p>
<hr
style="width:250px; text-align:left;margin-left:0; height: 0,1">
<p
style="line-height: 1.2; font-size: x-small; color: rgb(93, 93, 95);">
MTG AG - Dolivostr. 11 - 64293 Darmstadt, Germany<br>
Commercial register: HRB 8901<br>
Register Court: Amtsgericht Darmstadt<br>
Management Board: Jürgen Ruf (CEO), Tamer Kemeröz<br>
Chairman of the Supervisory Board: Dr. Thomas Milde<br>
<br>
This email may contain confidential and/or privileged
information. If you are not the correct recipient or have
received this email in error, <br>
please inform the sender immediately and delete this
email.Unauthorised copying or distribution of this email is
not permitted.<br>
<br>
Data protection information: <a
href="https://www.mtg.de/en/privacy-policy"
title="MTG Privacy policy" target="_blank"
moz-do-not-send="true">Privacy policy</a> </p>
</div>
</div>
</blockquote>
<div class="moz-signature">-- <br>
<!-- MTG AG HTML signature v.1.0, 2021-02-12 - Author: Andreas Cholet -->
<div style="font-family: Arial,serif">
<p
style="line-height: 1.5; font-size: small; color: rgb(93, 93, 95);"> <strong>MTG
AG</strong><br>
Dr. Falko Strenzke <br>
</p>
<p style="font-size: small; color: rgb(93, 93, 95);"> <span
style="display:inline-block;width:4em">Phone: </span>+49
6151 8000 24<br>
<span style="display:inline-block;width:4em">E-Mail: </span><a class="moz-txt-link-abbreviated" href="mailto:falko.strenzke@mtg.de">falko.strenzke@mtg.de</a><br>
<span style="display:inline-block;width:4em">Web: </span><a
href="https://www.mtg.de" title="MTG AG Internet"
target="_blank">mtg.de</a>
</p>
<hr
style="width:250px; text-align:left;margin-left:0; height: 0,1">
<p
style="line-height: 1.2; font-size: x-small; color: rgb(93, 93, 95);">
MTG AG - Dolivostr. 11 - 64293 Darmstadt, Germany<br>
Commercial register: HRB 8901<br>
Register Court: Amtsgericht Darmstadt<br>
Management Board: Jürgen Ruf (CEO), Tamer Kemeröz<br>
Chairman of the Supervisory Board: Dr. Thomas Milde<br>
<br>
This email may contain confidential and/or privileged
information. If you are not the correct recipient or have
received this email in error, <br>
please inform the sender immediately and delete this
email.Unauthorised copying or distribution of this email is
not permitted.<br>
<br>
Data protection information: <a
href="https://www.mtg.de/en/privacy-policy"
title="MTG Privacy policy" target="_blank">Privacy policy</a>
</p>
</div>
</div>
</body>
</html>