mirror of
https://codeberg.org/openpgp/notes.git
synced 2025-09-09 11:19:41 +02:00
Some progress. Swapped SEIPDv2 and v1 to improve readability
This commit is contained in:
Heiko Schaefer
parent
c3c8cc745f
commit
509abf7ee9
1 changed files with 49 additions and 31 deletions
|
|
@ -48,9 +48,37 @@ Two generations of encryption mechanisms are currently relevant in OpenPGP, and
|
|||
|
||||
Older, legacy encryption mechanisms exist in OpenPGP. However, those must not be used for encryption anymore. Messages encrypted using these legacy mechanisms may still be decrypted, although with caution. For more information see the [decryption](decryption_chapter) chapter.
|
||||
|
||||
SEIPD packets are typically used in combination with two mechanisms that provide *session keys*:
|
||||
|
||||
- [Public-Key Encrypted Session Key](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-public-key-encrypted-sessio) (PKESK) packets and
|
||||
- [Symmetric-Key Encrypted Session Key](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#skesk) (SKESK) packets.
|
||||
|
||||
The typical combination of mechanisms for encryption in OpenPGP is a [hybrid cryptosystem](hybrid_cryptosystems), consisting of [Public-Key Encrypted Session Key](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-public-key-encrypted-sessio) packets (PKESK), and a *Symmetrically Encrypted Integrity Protected Data* (SEIPD) packet. In this combination, an asymmetric cryptographic mechanism is used to protect a *session key*, with PKESK packets, and SEIPD packet is used to symmetrically encrypt the plaintext.
|
||||
|
||||
## Encapsulating session keys: PKESK, SKESK
|
||||
|
||||
"*ESK" (encrypted session-key) is a family of mechanisms for encapsulation of symmetric key material. It has two branches:
|
||||
|
||||
- [PKESK](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-public-key-encrypted-sessio): Uses asymmetric OpenPGP key material to protect a session key, and
|
||||
- [SKESK](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-symmetric-key-encrypted-ses): Uses passphrases to protect the symmetric key material, instead of OpenPGP asymmetric key material (this is less commonly used).
|
||||
|
||||
An arbitrary number of PKESKs and SKESKs can be used for the same message.
|
||||
|
||||
### PKESK: Session key encrypted to an asymmetric OpenPGP key
|
||||
|
||||
To encrypt an OpenPGP message for a recipient, the session-key is encrypted to the recipients public key. The resulting encrypted session key is packed into a PKESK packet, which holds essential metadata, like an identifier of the recipients encryption (sub)-key.
|
||||
|
||||
This procedure is repeated for each recipient of the message, and all resulting PKESK packets are prepended to the SEIPD packet (see below) containing the actual message.
|
||||
|
||||
### SKESK: Session key encrypted to a passphrase
|
||||
|
||||
As an alternative (or augmentation) to PKESK packets, a message can also be encrypted to a symmetric passphrase. This is done using a SKESK packet, which basically uses an S2K mechanism to derive a symmetric key from a passphrase, which is then either used directly as the session-key, or more commonly, used as a key-encapsulation-key (KEK) to encrypt the session-key.
|
||||
|
||||
Also see https://flowcrypt.com/docs/guide/send-and-receive/send-password-protected-emails.html
|
||||
|
||||
## Symmetric encryption of data, SEIPD
|
||||
|
||||
*Symmetrically Encrypted Integrity Protected Data* (SEIPD) packets represent the symmetric aspect of OpenPGP's encryption mechanism. The function of these packets is entirely independent of (asymmetric) OpenPGP keys. The SEIPD mechanisms only deal with symmetric cryptography.
|
||||
*Symmetrically Encrypted Integrity Protected Data* (SEIPD) packets represent the symmetric aspect of OpenPGP's encryption mechanism. The function of these packets is entirely independent of (asymmetric) OpenPGP keys.
|
||||
|
||||
A SEIPD packet contains the actual payload: the ciphertext of the encrypted message. For a large encrypted message, the SEIPD packet will also be large.
|
||||
|
||||
|
|
@ -58,36 +86,19 @@ A SEIPD packet contains the actual payload: the ciphertext of the encrypted mess
|
|||
SEIPD packets are the successor to the [Symmetrically Encrypted Data](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-symmetrically-encrypted-dat) packet, which is obsolete.
|
||||
```
|
||||
|
||||
Two versions of the SEIPD packet (separated by the version number) have been specified. Version 1, introduced in RFC4880, is used in OpenPGP v4 (and can be used with v6) while SEIPD version 2 was introduced with OpenPGP v6 and is not backwards compatible to OpenPGP v4.
|
||||
|
||||
When decrypted, the data contained in a SEIPD packet forms an [OpenPGP message](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-openpgp-messages). That is, the decrypted data consists of a series of OpenPGP packets.
|
||||
|
||||
In both versions of SEIPD, the decryptor must have obtained a *session key* in a previous step, before processing the SEIPD packet. Using this session key, the decryptor can decrypt the SEIPD packet and process the plaintext data that it contains.
|
||||
|
||||
Both versions of SEIPD can be used in combination with two mechanisms that provide *session keys*:
|
||||
|
||||
- [Public-Key Encrypted Session Key](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-public-key-encrypted-sessio) (PKESK) packets and
|
||||
- [Symmetric-Key Encrypted Session Key](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#skesk) (SKESK) packets.
|
||||
|
||||
The typical combination of mechanisms for encryption in OpenPGP is a [hybrid cryptosystem](hybrid_cryptosystems), consisting of [Public-Key Encrypted Session Key](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-public-key-encrypted-sessio) packets (PKESK), and a *Symmetrically Encrypted Integrity Protected Data* (SEIPD) packet. In this combination, an asymmetric cryptographic mechanism is used to protect a *session key*, with PKESK packets, and SEIPD packet is used to symmetrically encrypt the plaintext.
|
||||
|
||||
(SEIPDv2)=
|
||||
### v2 SEIPD, based on AEAD
|
||||
|
||||
The [version 2 SEIPD](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#version-two-seipd) mechanism was introduced in OpenPGP version 6, and is only supported by OpenPGP version 6 implementations. Consequently, it can only be used for encryption when all recipients support OpenPGP version 6. v2 SEIPD can only be combined with either [version 6 PKESK](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#v6-pkesk) and/or [version 6 SKESK](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#v6-skesk) packets.
|
||||
|
||||
In version 2 SEIPD, the *session key* is transformed into a *message key*, based on a salt value in the v2 SEIPD packet.
|
||||
|
||||
```{figure} drawio/SEIPDv2-PKESK.png
|
||||
:name: fig-encryption-seipdv2-pkesk
|
||||
:alt: TODO
|
||||
|
||||
With SEIPDv2, the message-key is derived from the session-key in an extra step.
|
||||
```
|
||||
|
||||
### v1 SEIPD, based on MDC
|
||||
|
||||
The [version 1 SEIPD](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#version-one-seipd) mechanism is supported by all modern OpenPGP version 4 implementations. It was introduced in [RFC 4880](https://www.rfc-editor.org/rfc/rfc4880.html#section-5.13).
|
||||
The [version 1 SEIPD](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#version-one-seipd) mechanism is supported by all modern OpenPGP version 4 implementations. It was introduced in [RFC 4880](https://www.rfc-editor.org/rfc/rfc4880.html#section-5.13) as a replacement for the *SED* (Symmetricaly Encrypted Data) packet. SEIPDv1 provides integrity protection of the ciphertext using a SHA-1 checksum of the plaintext as modification detection code.
|
||||
|
||||
Version 1 SEIPD can only be combined with either [version 3 PKESK](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#v3-pkesk) and/or [version 4 SKESK](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#v4-skesk) packets.
|
||||
Version 1 SEIPD can only be combined with [version 3 PKESK](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#v3-pkesk) and/or [version 4 SKESK](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#v4-skesk) packets.
|
||||
|
||||
In this version of the SEIPD packet, the session-key is used directly as message-key, meaning the payload is encrypted symmetrically using the session-key.
|
||||
|
||||
When communicating with a mix of recipients, some of whose OpenPGP software only supports OpenPGP version 4, then this mechanism must be used.
|
||||
|
||||
|
|
@ -98,18 +109,25 @@ When communicating with a mix of recipients, some of whose OpenPGP software only
|
|||
With SEIPDv1, the session-key is directly used as message-key to encrypt the payload
|
||||
```
|
||||
|
||||
## Handling encrypted session keys: PKESK, SKESK
|
||||
(SEIPDv2)=
|
||||
### v2 SEIPD, based on AEAD
|
||||
|
||||
"*ESK" is a family of mechanisms for dealing with symmetric key material. It has two branches:
|
||||
The [version 2 SEIPD](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#version-two-seipd) mechanism was introduced in OpenPGP version 6, and is only supported by OpenPGP version 6 implementations. Consequently, it can only be used for encryption when all recipients support OpenPGP version 6.
|
||||
It provides integrity protection of the ciphertext using *AEAD* (authenticated encryption with additional data).
|
||||
v2 SEIPD can only be combined with either [version 6 PKESK](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#v6-pkesk) and/or [version 6 SKESK](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#v6-skesk) packets.
|
||||
|
||||
- [PKESK](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-public-key-encrypted-sessio): Uses asymmetric OpenPGP key material to protect a session key, and
|
||||
- [SKESK](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-symmetric-key-encrypted-ses): Uses passphrases to protect the symmetric key material, instead of OpenPGP asymmetric key material (this is less commonly used).
|
||||
In version 2 SEIPD, the *session key* is transformed into a *message key*, based on a per-message salt value stored separately in the v2 SEIPD packet. The message key is then used in an AEAD scheme to encrypt the message payload.
|
||||
|
||||
### PKESK: Session key encrypted to an asymmetric OpenPGP key
|
||||
```{note}
|
||||
The session-key can use a different symmetric algorithm than the message-key.
|
||||
```
|
||||
|
||||
### SKESK: Session key encrypted to a passphrase
|
||||
```{figure} drawio/SEIPDv2-PKESK.png
|
||||
:name: fig-encryption-seipdv2-pkesk
|
||||
:alt: TODO
|
||||
|
||||
Also see https://flowcrypt.com/docs/guide/send-and-receive/send-password-protected-emails.html
|
||||
With SEIPDv2, the message-key is derived from the session-key in an extra step.
|
||||
```
|
||||
|
||||
## Advanced topics
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue