Crypto Refresh Implementation

[TJ-91]

Here a list of changes to RFC 4880 is given.

• S2K:
  • Argon2 https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-13#s2k-argon2
  • Secret key encryption: AEAD "S2K usage octet" (Section 3.7.2 and Section 5.5.3)

Subpackets:

• Subpacket: Intended Recipient Fingerprint (Section 5.2.3.36)

  • SHOULD

• Features subpacket: add flag for SEIPDv2 (Section 5.2.3.32)

  • can parse, add to key sig when generating
  • need to take into account when creating messages
  • Check for SEIPDv2 Feature Flag in rnp_ctx_t::pkeskv6_capable() #51

• Subpacket: Preferred AEAD Ciphersuites (Section 5.2.3.15)

  • can parse, add to key sig when generating
  • need to take into account when creating messages

• Version 6 One-Pass Signatures (Section 5.4)

  • To Do: Check ! When are they generated anyway?

• Version 6 SKESK Section 5.3.2 #61

• Self-verifying revocation certificate (Section 10.1.2)

  • Parsing key + revocation is enough (no direct-key sig etc needed)

• User ID is explicitly optional (Section 10.1.1)

• Packet: Padding (Section 5.14)

• Message structure: Packet Criticality (Section 4.3)

  • first check the state in RNP

• Direct-Key-Sigs: Require them, prefer to store preferenes and gather preferences there.

  • Check v6 direct-key self signature #3

• ASCII Armor:

  • Ignore, do not emit CRC (Section 6.1)
  • Do not emit "Version" armor header (Section 6.2.2.1)
  • Issue No CRC24 Checksum for v6 #24

• Cleartext Signature Framework:

  • Ignore, avoid emitting unnecessary Hash: headers (Section 6.2.2.3)
  • Reject CSF signatures with invalid Hash: headers (Section 6.2.2.3) or any other Armor Header (Section 7.1)

Deprecations:

• Public Key Algorithms:

  • Avoid RSA weak keys (Section 12.4)
  • Avoid DSA (Section 12.5)
  • Avoid ElGamal (Section 12.6, Section 5.1.4)
  • For Version 6 Keys: Avoid EdDSA25519Legacy, Curve25519Legacy (Section 9.2)

• Digest Algorithms:

  • Avoid MD5, SHA1, RIPEMD160 (Section 9.5)

• Symmetric Key Algorithms:

  • Avoid IDEA, TripleDES, CAST5 (Section 9.3)

• S2K Specifier:

  • Avoid Simple S2K (Section 3.7.1.1)
  • Secret Key protections (a.k.a. S2K Usage):
  • Avoid MalleableCFB (Section 3.7.2.1)

• Packet Types:

  • Avoid Symmetrically-Encrypted Data (Section 5.7, Section 13.7)

• Literal Data packet metadata:

  • Avoid Filename and Date fields (Section 5.9)
  • Avoid Special _CONSOLE "filename" (Section 5.9.1)

• Packet Versions:

  • Avoid Version 3 Public Keys (Section 5.5.2.1)
  • Avoid Version 3 Signatures (Section 5.2)

• Signature Types:

  • Avoid Reserved Signature Type ID 0xFF (Section 5.2.1.16, Section 5.2.4.1)

• Signature Subpackets:

  • For Version 6 Signatures: Avoid Issuer Key ID (Section 5.2.3.12)
  • Avoid Revocation Key (Section 5.2.3.23)

• Add all C-R test vectors for implemented features #62