Subject: [Openpgp-dt] settling on OCB nonce size of 120 bits?

From: Daniel Kahn Gillmor <[email-masked]>
Date: Fri, 01 Apr 2022 14:45:31 -0400

Hi folks--

Over in https://gitlab.com/openpgp-wg/rfc4880bis/-/issues/83 we were
discussing questions about whether we're actually ok going with an OCB
nonce size of 120 bits.

The main concerns raised were whether any implementers would have
difficulty with interfaces that were limited to 96 bits.  A casual
survey of underlying cryto libraries that offer an OCB interface
turned up one with that limitation (python's cryptography module), but
that has since been fixed:

   https://github.com/pyca/cryptography/issues/6894

I worked with Ted Krovetz to construct test vectors for OCB with 120-bit
nonces using similar code to the code that generated the 96-bit nonce
test vectors in the OCB RFC:

    https://gitlab.com/dkg/ocb-test-vectors

So i'm inclined to say that we just go with 120-bit nonces, and close
issue 83 as resolved.

Does anyone want to try to gather more data, or can we just close the
issue?

        --dkg

---

From: Paul Wouters <[email-masked]>
Date: Tue, 5 Apr 2022 15:08:26 -0400 (EDT)

>    https://gitlab.com/dkg/ocb-test-vectors

Can I encourage you to put this into a draft and throw it into LAMPS?
We are also doing something similar for test keys by Peter Guttman:

https://datatracker.ietf.org/doc/draft-gutmann-testkeys/

> So i'm inclined to say that we just go with 120-bit nonces, and close

I agree.

> Does anyone want to try to gather more data, or can we just close the

I'm fine with closing the issue.

Paul

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Tue, 05 Apr 2022 13:51:51 -0700

> https://datatracker.ietf.org/doc/draft-gutmann-testkeys/

I'm happy to put these vectors in an IETF draft, but i didn't know where
to put it.  how did you decide that LAMPS is the right group?  there's
nothing PKIX or S/MIME about it.

> I'm fine with closing the issue.

I've just closed it, thanks for the feedback!

     --dkg