Subject: [openpgp] Request on Adding ChaCha20-Poly1305 to the OpenPGP Standardization

From: "Tanveer.Salim" <[email-masked]>
Date: Wed, 15 Apr 2020 17:53:31 +0000

Dear IETF,

Hello. I am Tanveer Salim and am a Computer Engineering Student from Texas Tech University.

Firstly, I would like to thank you for taking the time to work on GNUPG for all these years.

I personally am really glad you are willing to ensure people have a sound option for secure communication on the internet.

I discussed the pros and cons of using ChaCha20-Poly1305 first with the ProtonMail Security Team on a Reddit Forum:

(https://www.reddit.com/r/ProtonMail/comments/g0pa55/protonmail_securitys_opinion_on_using_the/)

and as of now with the creators of WireGuard VPN.

ProtonMail users and the ProtonMail Security Team admitted that most hardware devices already have hardware support for AES-GC 256-bit encryption and therefore AES-GCM 256-bit will be faster than a pure-software implementation of ChaCha20.

Jason Dononfeld, one of the creators of WireGuard VPN, said that although that was true ARX-512 bit vector extensions for the Intel and AMD instruction set architectures will allow hardware-accelerated implementations of ChaCha20-Poly1305 to run even faster than hardware-accelerated implemetnations of AES (e.g. AES-NI). (https://www.wireguard.com/papers/wireguard.pdf)

This was why Jason Dononfeld and the rest of the WireGuard VPN team made ChaCha20-Poly1305 the primary, exclusive AEAD in their VPN.

For now, support for AVX-512 bit instructions is not as widespread just yet. But that should be the case in a matter of a few years as cited in the WireGuard VPN Whitepaper.(https://en.wikipedia.org/wiki/AVX-512).
(https://www.wireguard.com/papers/wireguard.pdf)

For now, although ProtonMail is mostly correct in their saying that hardware-accelerated AES is faster than pure-software, Jason Dononfeld definitely seems to be making a strong argument for using ChaCha20-Poly1305. Soon in the future, ARX-512 bit vector extensions will allow hardware-accelerated ChaCha20-Poly1305 to run faster than hardware-accelerated AES.

ProtonMail did admit it would be a good idea to try to add the ChaCha20-Poly1305 to OpenPGP and WebCrypto. Afterwards, they would be happy to add support for ChaCha20-Poly1305.

This is perhaps also why other projects are adding support for ChaCha20-Poly1305 as we speak.

Other famous projects that are using ChaCha20-Poly1305 in their works include NordPass (https://nordpass.com/features/xchacha20-encryption/), KeePassXC, and SSH (http://blog.djm.net.au/2013/11/chacha20-and-poly1305-in-openssh.html).

Considering the growing usage of ChaCha20-Poly1305, would you consider adding ChaCha20-Poly1305 as an additional cipher to your draft of OpenPGP standardization. I noticed you were working on a new draft for OpenPGP in RFC 4880bis: (https://tools.ietf.org/html/draft-ietf-openpgp-rfc4880bis-09).

Libgcrypt already supports ChaCha20 and Poly1305 individually after all. But OpenPGP does not yet accept ChaCha20-Poly1305 as an additional/experimental cipher yet.

Since you are the lead developer of GNUPG, which is the world's most influential implementation of OpenPGP, you could certainly make it an additional cipher to OpenPGP.

With saying all of this, I would like to ask if you are now considering to add ChaCha20-Poly1305 itself to the OpenPGP standardization?

I thank you for any responses to send back to me.

I actually first emailed Werner Koch directly and has given me permission to reiterate his response:

-------------------------------------------------------------------------------------------------------------------------

Werner Koch's Response Below:

Hi!

Thanks for the long writeup but you should better direct this mail to
the IETF WG list: [email-masked] which is the appropriate place for
such requests.

The set of cipher algorithms in OpenPGP is long and actually longer than
we like it.  Most of the extra cipher algorithms are there for political
reasons (e.g. Camellia) and in practice not used.  We have settled long
ago for AES because that is a the best block cipher algorithm we have
and main stream CPUs provide hardware acceleration for it.

Regarding encryption modes, we are using CFB+MDC and are preparing to
move on to OCB and EAX (with the latter only there for political/patent
fears).  This allows us keep on using AES.  Changing to a stream cipher,
as you propose is very unlikely.

You may however use the experimental range of algo identifiers for
ChaCha but that won't be useful for production.  Replacing algorithms
takes years and we are not even there to enable OCB or EAX modes.

Shalom-Salam,

   Werner

ps.
if you want to post to the WG list, feel free to include this mail.

--
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.

So Mr. Koch admits that there are political problems and technical issues with adding ChaCha20-Poly1305. Political in the sense that many implementations will be offended if the switch was made from AES to ChaCha20-Poly1305. I am not saying we should necessarily switch the official standard from AES to ChaCha20-Poly1305. Just to add ChaCha20-Poly1305 as an alternative. The technical challenge was that even the OCB and EAX mode meant to improve AES performance were not even added yet.

Finally, I have one more additional question.

According to the Autocrypt website, it would be great if Argon2 and SCrypt key derivation functions to OpenPGP as well. But Autocrypt admitted that this is yet to be done. (https://autocrypt.readthedocs.io/en/latest/faq.html)

So will the IETF be trying to add support for both key derivation functions in the current draft for RFC 4880bis?

I thank the IETF for updating OpenPGP and taking the time to send back any replies to me.

Sincerely,

Tanveer Salim

Sent with ProtonMail Secure Email.

---

From: Bart Butler <[email-masked]>
Date: Wed, 15 Apr 2020 22:20:36 +0000

Hi Tanveer,

Thanks for the suggestion. I'll be the first to admin that ChaCha20-Poly1305 is a great symmetric algorithm.

That said, there's nothing really wrong with AES, and I agree with Werner that if anything the OpenPGP specification has too many ciphers rather than too few (though most of these are asymmetric, to be fair). More ciphers mean more work to implement and maintain the OpenPGP spec, and there has already been so much effort on the cryptographic refresh for OpenPGP, and so many implementations which are done or close to implementing the current draft, that the likelihood of adding yet another cipher to the mix I'd say is slim, despite it being, on the merits, a good one.

Another thing worth mentioning is that OpenPGP messages are archival. Removal of algorithms is always hard, because you need to still be able to decrypt old messages. In contrast, most of the examples you have cited involve transient transport-layer security, which is ephemeral and therefore easier to drop legacy support. The same goes for those protocols and examples being non-distributed organizations--if you only have to be compatible with yourself, you can do whatever you'd like, which is essentially Werner's point about experimental algorithms.

What this means is that we'd never be able to "drop" AES--the best we could do is add ChaCha and wait for the major implementations to add it. This would in turn delay the cryptographic refresh of OpenPGP by even more, introduce more opportunities for incompatibilities between implementations, and increase the algorithm bloat of OpenPGP for a minor speed and security benefit, and, because OpenPGP messages last forever, it would obligate that support to continue for the next several decades. It does not seem worth it to me, at least at this time.

Cheers,

Bart Butler
Proton CTO

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

> -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
> 

> -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
> 

> openpgp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/openpgp

---

From: Paul Wouters <[email-masked]>
Date: Wed, 15 Apr 2020 19:03:42 -0400

> What this means is that we'd never be able to "drop" AES--the best we could do is add ChaCha and wait for the major implementations to add it. This would in turn delay the cryptographic refresh of…

I wholeheartedly agree with this statement.

Paul

---

From: Peter Gutmann <[email-masked]>
Date: Thu, 16 Apr 2020 01:46:50 +0000

Bart Butler <bartbutler=[email-masked]> writes:

>It does not seem worth it to me, at least at this time.

Another problem with ChaCha20-Poly1305 is that it's incredibly brittle unless
you get the keying details exactly 100% right.  There's at least two full-
blown lengthy RFCs written that cover nothing but the complex keying
requirements, and if you get them wrong you get a catastrophic failure of
security.  For things like TLS it may not be that bad because an attacker
would have to intercept and analyse live data at a particular point in time,
while for OpenPGP they could go back years later to stored data to take
advantage of a flaw.  It's like using nitroglycerine vs. TNT, they both have
the same end effect if you get everything just right, but I'd never even
consider the former.

Peter.

---

From: Werner Koch <[email-masked]>
Date: Thu, 16 Apr 2020 07:09:30 +0200

On Wed, 15 Apr 2020 17:53, Tanveer.Salim said:

> issues with adding ChaCha20-Poly1305. Political in the sense that many
> implementations will be offended if the switch was made from AES to
> ChaCha20-Poly1305. I am not saying we should necessarily switch the

Well, that was not exactly my point.  With political I meant that we had
to add a couple of algorithms to please some countries or make it
possible for them to use OpenPGP.  That is for example the case for
Camellia, the Brainpool and NIST curves.

> According to the Autocrypt website, it would be great if Argon2 and
> SCrypt key derivation functions to OpenPGP as well. But Autocrypt

Well, we are doing public key crypto and thus passwords are not of
primary interest.  If OpenPGP is used with symmetric-only encryption I
expect that a full-entropy key is used and thus the KDF is not used for
security reasons.

Shalom-Salam,

   Werner

---

From: Hanno Böck <[email-masked]>
Date: Thu, 16 Apr 2020 17:19:11 +0200

Given that you quoted Jason Donenfeld quite a bit I propose that you
actually ask him for his design criteria.

Because what you seem to propose is adding more and more variations to
OpenPGP. I discussed this with Jason before and he's a strong advocate
of less choices and strongly against algorithm agility. And I agree.

FWIW I believe the pros and cons of the different AEAD ciphers are of
very minor relevance, yet the algorithm zoo is a big downside. From what
I know openpgp has still not published a standardized AEAD. My proposal
would be to choose one and only one AEAD and declare all other
algorithms as deprecated. And which one almost doesn't matter. And I'm
pretty sure Jason would agree with me on that, but feel free to ask him.

-- 
Hanno Böck
https://hboeck.de/

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 16 Apr 2020 16:30:50 +0100

> pretty sure Jason would agree with me on that, but feel free to ask him.

+1 to that. Even though the semantics of deprecated for
mail and pgp applications in general is tricky, I think
this'd make sense.

S.

---

From: Bart Butler <[email-masked]>
Date: Thu, 16 Apr 2020 16:12:03 +0000

I think we are all in agreement on this, with the only multiple options (OCB and EAX) being present largely to address patent concerns, as Werner said earlier.

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Thursday, April 16, 2020 8:30 AM, Stephen Farrell <[email-masked]> wrote: