3 ms·

Huh, PGP encrypted messages aren't authenticated? (No HMAC etc)

by mkj 8y ago

deleted 8y ago
[deleted]
consp 8y ago
Most clients incorporate Authenticated Encryption but since some don't work well with it, it is not a decrypt failure if not present. It should be and solves the problem as per what Koch said [1]. [1] https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060315.html https://lists.gnupg.org/pipermail/gnupg-users/2018-May/06031...
A1kmm 8y ago
If I have your key, I can send you an encrypted GPG message, without you needing to know who am, or for any kind of message from you back to me. HMACs require a shared secret. GPG does optionally support signing, which provides for integrity for message contents, but it is optional, so is not a useful mitigation here. It supports a Modification Detection Code (MDC), which is just a hash of the message. In scenarios where GPG won't decrypt without an MDC being present, it would be a reasonable defence against this attack, because to generate a valid MDC, you would need to know the entire contents of the message, and if you know the entire contents of the message, you wouldn't gain anything from this attack.
- CiPHPerCoder 8y ago
  > If I have your key, I can send you an encrypted GPG message, without you needing to know who am, or for any kind of message from you back to me. HMACs require a shared secret. No, they don't. I described a naive RSA+AES hybrid cryptosystem here that includes HMAC authentication without a pre-shared key: https://paragonie.com/blog/2018/04/protecting-rsa-based-protocols-against-adaptive-chosen-ciphertext-attacks https://paragonie.com/blog/2018/04/protecting-rsa-based-prot...
- floatboth 8y ago
  > optional, so is not a useful mitigation here Why in the heck does anyone ever send encrypted-only, non-signed messages?!?!
  - AgentME 8y ago
    Other than anonymity, non-repudiation is a possibility. I may not want the recipient of my messages to be able to undeniably prove what I said to them. This case is important if I'm saying unflattering things about a mutual friend, or my messages could be read as admitting a crime, etc. (Though note that the vulnerability here still applies to signed messages too: https://efail.de/#will-signatures https://efail.de/#will-signatures)

Huh, PGP encrypted messages aren't authenticated? (No HMAC etc)

by mkj 8y ago

Huh, PGP encrypted messages aren't authenticated? (No HMAC etc)

deleted 8y ago

[deleted]

consp 8y ago

Most clients incorporate Authenticated Encryption but since some don't work well with it, it is not a decrypt failure if not present. It should be and solves the problem as per what Koch said [1]. [1] https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060315.html https://lists.gnupg.org/pipermail/gnupg-users/2018-May/06031...

A1kmm 8y ago

If I have your key, I can send you an encrypted GPG message, without you needing to know who am, or for any kind of message from you back to me. HMACs require a shared secret. GPG does optionally support signing, which provides for integrity for message contents, but it is optional, so is not a useful mitigation here. It supports a Modification Detection Code (MDC), which is just a hash of the message. In scenarios where GPG won't decrypt without an MDC being present, it would be a reasonable defence against this attack, because to generate a valid MDC, you would need to know the entire contents of the message, and if you know the entire contents of the message, you wouldn't gain anything from this attack.

CiPHPerCoder 8y ago
> If I have your key, I can send you an encrypted GPG message, without you needing to know who am, or for any kind of message from you back to me. HMACs require a shared secret. No, they don't. I described a naive RSA+AES hybrid cryptosystem here that includes HMAC authentication without a pre-shared key: https://paragonie.com/blog/2018/04/protecting-rsa-based-protocols-against-adaptive-chosen-ciphertext-attacks https://paragonie.com/blog/2018/04/protecting-rsa-based-prot...
floatboth 8y ago
> optional, so is not a useful mitigation here Why in the heck does anyone ever send encrypted-only, non-signed messages?!?!
- AgentME 8y ago
  Other than anonymity, non-repudiation is a possibility. I may not want the recipient of my messages to be able to undeniably prove what I said to them. This case is important if I'm saying unflattering things about a mutual friend, or my messages could be read as admitting a crime, etc. (Though note that the vulnerability here still applies to signed messages too: https://efail.de/#will-signatures https://efail.de/#will-signatures)