4 ms·

Given that they recommend against decrypting any email, it sounds like the bug is some sort of remote-code-execution against the decryption step, that would the

Given that they recommend against decrypting any email, it sounds like the bug is some sort of remote-code-execution against the decryption step, that would then allow (among ~anything else) exfiltration of keys, ciphertexts, and plaintexts. EDIT: Having read a bit more I'm not so convinced that this explanation makes sense.

rococode 9y ago
The original tweet linked in the article [1] says "They might reveal the plaintext of encrypted emails, including encrypted emails sent in the past.", so at least that much is probably compromised. They also say there are currently no reliable fixes, which seems to suggest the problem is a flaw in PGP's design rather than a security bug in some specific library or tool, since a simple (but widespread) bug would most likely have a clear fix. [1] https://twitter.com/seecurity/status/995906576170053633 https://twitter.com/seecurity/status/995906576170053633
- jstanley 9y ago
  Good point. I wonder what kind of flaw in PGP's design could make it unsafe to decrypt incoming mails.
  - skunkworker 9y ago
    It'll be interesting to see the flaw that many pgp clients all seemed to implement in the same/similar ways.
  - im3w1l 9y ago
    At a guess: 1. Take previous email (X) that you want to decrypt. 2. Apply transformation (this is the actual secret sauce) to previous X to get email Y. 3. Because of how Y was constructed, decrypting it causes X to be decypted. 4. Phone home with the result by using some kind of tracking pixel. My reasoning is that they didn't talk about RCE and they didn't talk about stealing the key, and they did warn about automatic decryption, so it should be about tricking the decryptor into decrypting whatever you want for you.
    - jstanley 9y ago
      Update: you were right :)
- jwildeboer 9y ago
  They claim this also affects S/MIME, so concluding a flaw only in GPG/PGP seems to be wrong.
  - giancarlostoro 9y ago
    It seems more to be with the mail clients themselves given that to avoid the exploit your best best is not to render HTML emails. That is outside of the scope of goals for the encryption libraries altogether.

rococode 9y ago

The original tweet linked in the article [1] says "They might reveal the plaintext of encrypted emails, including encrypted emails sent in the past.", so at least that much is probably compromised. They also say there are currently no reliable fixes, which seems to suggest the problem is a flaw in PGP's design rather than a security bug in some specific library or tool, since a simple (but widespread) bug would most likely have a clear fix. [1] https://twitter.com/seecurity/status/995906576170053633 https://twitter.com/seecurity/status/995906576170053633

jstanley 9y ago
Good point. I wonder what kind of flaw in PGP's design could make it unsafe to decrypt incoming mails.
- skunkworker 9y ago
  It'll be interesting to see the flaw that many pgp clients all seemed to implement in the same/similar ways.
- im3w1l 9y ago
  At a guess: 1. Take previous email (X) that you want to decrypt. 2. Apply transformation (this is the actual secret sauce) to previous X to get email Y. 3. Because of how Y was constructed, decrypting it causes X to be decypted. 4. Phone home with the result by using some kind of tracking pixel. My reasoning is that they didn't talk about RCE and they didn't talk about stealing the key, and they did warn about automatic decryption, so it should be about tricking the decryptor into decrypting whatever you want for you.
  - jstanley 9y ago
    Update: you were right :)
jwildeboer 9y ago
They claim this also affects S/MIME, so concluding a flaw only in GPG/PGP seems to be wrong.
- giancarlostoro 9y ago
  It seems more to be with the mail clients themselves given that to avoid the exploit your best best is not to render HTML emails. That is outside of the scope of goals for the encryption libraries altogether.