Hi! Some may have noticed that the EFF has warnings about the use of PGP out which I consider pretty overblown. The GnuPG team was not contacted by the researchers but I got access to version of the paper related to KMail. It seems to be the complete paper with just the names of the other MUAs redacted.
Given that the EFF suggests to deinstall GpgOL, we know tha it is not vulnerable; see see https://dev.gnupg.org/T3714.). Here is a response I wrote on the weekend to a reporter who inquired on this problem. ============= The topic of that paper is that HTML is used as a back channel to create an oracle for modified encrypted mails. It is long known that HTML mails and in particular external links like <img href="tla.org/TAG"/> are evil if the MUA actually honors them (which many meanwhile seem to do again; see all these newsletters). Due to broken MIME parsers a bunch of MUAs seem to concatenate decrypted HTML mime parts which makes it easy to plant such HTML snippets. There are two ways to mitigate this attack - Don't use HTML mails. Or if you really need to read them use a proper MIME parser and disallow any access to external links. - Use authenticated encryption. The latter is actually easy for OpenPGP because we started to use authenticated encryption (AE) since 2000 or 2001. Our AE is called MDC (Modification detection code) and was back then introduced for a very similar attack. Unfortunately some OpenPGP implementations were late to introduce MDC and thus GPG could not fail hard on receiving a mail without an MDC. However, an error is returned during decrypting and no MDC is used: gpg: encrypted with 256-bit ECDH key, ID 7F3B7ED4319BCCA8, created 2017-01-01 "Werner Koch <w...@gnupg.org>" [GNUPG:] BEGIN_DECRYPTION [GNUPG:] DECRYPTION_INFO 0 7 [GNUPG:] PLAINTEXT 62 1526109594 [GNUPG:] PLAINTEXT_LENGTH 69 There is more to life than increasing its speed. -- Mahatma Gandhi gpg: WARNING: message was not integrity protected [GNUPG:] DECRYPTION_FAILED [GNUPG:] END_DECRYPTION When giving a filename on the command line an output file is even not created. This can't be done in pipe mode because gpg allows to process huge amounts of data. MUAs are advised to consider the DECRYPTION_FAILED status code and not to show the data or at least use a proper way to display the possible corrupted mail without creating an oracle and to inform the user that the mail is fishy. For S/MIME authenticated encryption is not used or implemented in practice and thus there is no short term way to fix this in S/MIME except for not using HTML mails. The upshot of this is that OpenPGP messages are way better protected against such kind of attacks than S/MIME messages. Unless, well, the MUAs are correctly implemented and check error codes! Shalom-Salam, Werner p.s. Some cryptographers turn up their nose at the OpenPGP MDC which is an ad-hoc AE mode from a time before AE received much research. However, it does it job and protects reliable against this and other attacks. The next OpenPGP revision will bring a real AE mode (EAX or OCB depending on key preferences) which has other benefits (early detection of corrupted messages, speed) but it will takes years before it will be widely deployed and can can actually be used to create messages. -- # Please read: Daniel Ellsberg - The Doomsday Machine # Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.
pgpYHVz2OlsTL.pgp
Description: PGP signature
_______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
