3 ms·
From what I've read, I thought that in modern cryptographic methods you always authenticate and encrypt, in part to avoid attacks like this where an attacker ca
by fabian2k 8y ago
From what I've read, I thought that in modern cryptographic methods you always authenticate and encrypt, in part to avoid attacks like this where an attacker can modify the encrypted message in some way.
Does this mean that GnuPG and S/MIME don't authenticate/sign encrypted messages at all? Or that email clients still try to display encrypted messages that are not properly authenticated?
- AnaniasAnanas 8y agoOpenPGP does have a way to authenticate the messages, see https://tools.ietf.org/html/rfc4880#section-5.13 https://tools.ietf.org/html/rfc4880#section-5.13.
- dewyatt 8y agoAlso tag 20 is the newer AEAD method: https://tools.ietf.org/html/draft-ietf-openpgp-rfc4880bis-04#page-60 https://tools.ietf.org/html/draft-ietf-openpgp-rfc4880bis-04...
- AnaniasAnanas 8y agoThanks for that, I was not aware of the draft. It seems that they provide support for OCB and EAX. I would prefer support for chapoly to be honest.
- deleted 8y ago[deleted]
- baby 8y agoYup, they don't authenticate encrypted mails.