0
$\begingroup$

Here is a GPG message, signed and encrypted (strictly for demonstration, with test keys):

-----BEGIN PGP MESSAGE-----

hQGMAyxbH69MHihtAQv/Z5FROYmcGwAWeomk+1b1ps4EQaLkUDU+iYKzhEojEDJa
pxbZB5yUsLlrEmJXMis3Jt4eSMvRpj6xUVR9cJHbWPAOTK1S6PMASquFIagNY0c7
dIoShPSlPDjSb1Vi/0drqZUoEkjeB3fnqRb3ECTwBbU24Ygq/MD5Jtf0pGLmcXxT
ZAM4Sbtta0pfCFKjfkV22jQiu/mfbxd05DrCkG64hhLvtmNI8R3iperlYIp41z53
8aaK5/FvASX8u1ngyzldiKc7TmVE8ypuGWs1bjD94H33YsJlyQFg/XTUr/aV2O1e
1YkKkjT3MdQ2iNDeuxpJFqeP8ZS3iEx99cTSWEzUXYg7EaAbVS7F23Rtb1DwL4cE
H0MuDa+aeWaRcGKO1DfW+QIJYoQxEm9X/jklGoEfc07Rsm0RhfO/sYW/JlKg9xX/
pDKWW4fC1bmELEmKz/U48CmqWBRKwLsGSuEEgycqox92uY8tov6RIG7cfTz5s0bI
7wsRV7TXboPv0xHhWFoQ0ukBFQuiJZC0UltJlHGCypb2I7xF0BW5KTHhv3ml4Jtd
asuR03aFjyHW+K81IV/OAd5H9fUH2ixz/DrbeyWQ4xXKoAdFJNqUX/4dVteYW9Uv
jaJcH3+0N8q/SJb/VHvKfAyE//5Qr6N9gjGga6MzNLfmA5659KY+P1hOvjPi0AaN
3uUYiG4QLSfToLA9qqDpHfp1M/Syg9LleX+JyPooBYiV8WZOhpGBxcE1yet1Qija
Qp23joj3vvhdPoK1XmBIRABWGbtPGTCSKBI3/YNtHcsARtHYSTMpSH4PtSu0Au17
vBKbOgkdz4bwy/wqfyJOFYQmoK5YLEnTlZL7eKBNZYqzMvoQpt63Q4mqvoVc8reS
odVXYFPs7Bz1zmevZf1BMx56ZRPBk0nRZRjGQtLKnOuARLzbkad0pCm213vau32D
jRyS9JlTX9XuMicVpExyjfUoXb28Z1MZpTCfnHKUXMXJl83NjSjcI4KYipSNhQ3R
QgUuaWb2K0PXu6D8Cv9F2QzvhpWQ9MDaCyVjCIUSwS1DgU4fwVlw4COVJNqFvuUd
STIedU/yqoUy8AlaFScoXR2vdh5IgyPIxgkRHrMBHCR5UbGuXXiIIow+8zWN5jDu
gPUZgFx27CZC4OMAE0uD5lBLNV6nQDcbKUvYRRW6H2QTwwCb5TKCGlP3HSyuCinO
JDZ9tAtPWkS98WjYshU4UVX+z1TIziuX9TMmviG4bLdYRECtQl04oez3N0gU210f
eSmOXA3d4lc=
=q3qY
-----END PGP MESSAGE-----

Here is its HMAC-SHA512 value:

/Uz8oVQr5ILR52r6ngYAHH6X/viEGwbRTQ55SocixqyaCsjdzGzPosqLDcgZwMH0k+F42D+9WcwR67JALmS2bQ==

Concatenate the entire block of the GPG message with the HMAC-SHA512 value.

Now pass a one-time pad over the whole thing. Send. Of course, the one-time pad will have been properly generated, secured, and shared.

Pieces of the one-time-pad key were just given away because the format of the underlying gpg message is, of course, known. In this case, there is no transposition.

Questions:

  1. Is this authenticated encryption?
  2. Is this quantum resistant?

As far as I can tell, bit flipping is not going to have any advantages; having known plaintext does not seem to make any meaningful sense. Factoring advantages against RSA surly will not help, nor will inverting SHA-1. Is that right?

$\endgroup$
3
  • $\begingroup$ Thanks for that. I want to know for sure that bit flipping is not going to work in this scenario. $\endgroup$ – Axel H. Oct 4 '20 at 11:15
  • 2
    $\begingroup$ If the message is signed-then-encrypted then I don't see the point of the HMAC. It would be a bit tricky to even perform an analysis of the signature using a quantum computer if the signature is not known. OTOH, it is of course fine to add it, and you'd be at least sure that nobody removed part of the ASCII armor or other meta data around the signed & encrypted message. $\endgroup$ – Maarten Bodewes Oct 4 '20 at 11:46
  • $\begingroup$ @MaartenBodewes The end user does not trust GPG as it is: not the use of SHA-1, not the artitrary arrangement of packets, not the MDC packet, among other reasons. That is why the HMAC is used and an OTP is passed over the whole thing. $\endgroup$ – Axel H. Oct 5 '20 at 0:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.