Subject: Re: V3 secret keys

From: [email-masked] ("Hal Finney")
Date: Wed, 15 Feb 2006 12:13:41 -0800 (PST)

Ben Laurie writes:
> No, I can't confirm that. I have code that works as we all expect CFB to
> work (modulo "resync") on v4 secret keys. I had to make the change I
> described to decrypt v3 keys. It seems to me rather unlikely that I have
> it wrong given that I had to reverse engineer and write new code to get
> a working implementation for v3!

To clarify, you are claiming that to unlock a V3 secret key, you don't
use the IV as usual in CFB mode.  Instead, you use an all-zero buffer
for the IV, and then prepend the IV from the secret key subpacket to
the data, decrypt that, and discard the first block of output?

So in other words, to get the first block of plaintext you do, in effect:

buf1 = Enc (all-zeros);
buf2 = buf1 xor IV;
buf3 = Enc (buf2);
buf4 = buf3 xor ciphertext

and buf4 will be the first block of plaintext?  You say your code does
this, and it works????

My code does this:

buf1 = Enc (IV);
buf2 = buf1 xor ciphertext

and buf2 is the first block of plaintext.

I just checked GPG and I confirmed that they work the same way I have
said.

Could you possibly show a few lines of your code, that does this step?
It's simply impossible for your code to be working as I have described
above, and to interoperate with existing V3 keys.  Either I misunderstood
your claim about the need for an all-zero IV, or you have misunderstood
what your own code is doing.

Hal Finney

---

From: Ben Laurie <[email-masked]>
Date: Thu, 16 Feb 2006 10:59:26 +0000

> the data, decrypt that, and discard the first block of output?

Yes.

> what your own code is doing.

The code is publicly available: http://openpgpsdk.nominet.org.uk/.

But what I'm going to do is instrument it so we can all see exactly what
is going on. Watch this space :-)

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

From: Ben Laurie <[email-masked]>
Date: Fri, 17 Feb 2006 07:59:40 +0000

> The code is publicly available: http://openpgpsdk.nominet.org.uk/.

This should have been http://openpgp.nominet.org.uk/, sorry.

Cheers,

Ben.

---

From: Ben Laurie <[email-masked]>
Date: Sun, 19 Feb 2006 15:47:33 +0000

> what your own code is doing.

In fact, after discussion with Hal, we've established that:

a) Both of us are correct about what our code is doing

b) The two algorithms are effectively the same (for decryption, at least).

c) There was a bug in my code related to resyncing that setting the IV
"the hard way" worked around - which is why it appeared that v3 keys
were crypted differently.

So, we're in agreement about how it works now. My complaint about
"resyncing" stands, however.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html           http://www.links.org/