Skip to content

AEAD's authenticated data includes chunk index, seems unnecessary and prevents optimization

The authenticated data contains the chunk index: https://openpgp-wg.gitlab.io/rfc4880bis/#section-5.16-10

It is not clear what the benefit is, because the chunk index is also part of the nonce, and therefore if one were to reorder or remove chunks, they would neither decrypt nor authenticate, even without having the chunk index as part of the AD.

On the other hand, if the nonce index would not be included, this would open up an opportunity for optimization, because the authenticated data can be processed just once for all chunks (and then once more with the length for the final tag).