4 ms·

Secure systems cannot use either a signature or authenticated encryption. Signing a message is not sufficient to prevent tampering that leads to an attacker rea

Secure systems cannot use either a signature or authenticated encryption. Signing a message is not sufficient to prevent tampering that leads to an attacker reading the message by seeing errors in processing the tampered message. You need either authenticated encryption or signcryption. Suppose your format is ciphertext || signature. An attacker can strip off the signature, modify the ciphertext, and then sign the modified ciphertext as coming from an attacker controlled account. The recipient will then accept the ciphertext, decrypt it, and parse it. Errors on decrypting or parsing induced by mutations can then be used to get the plaintext. This isn't theoretical. It happened to iMessage[1] and GPG[2] And no, you cannot just include the sender inside the ciphertext. iMessage tried that. It didn't work. In general, there are two problems 1) the ciphertext is malleable and the id can be changed. 2) the error could happen before you can read the sender id from the ciphertext. Signing and authenticated encryption really don't do the same thing. [1]https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_garman.pdf https://www.usenix.org/system/files/conference/usenixsecurit... [2]https://efail.de/ https://efail.de/

kerng 6y ago
Isn't that why HMAC exists?
upofadown 6y ago
This is the best example of an attack against PGP encryption malleability that I have come across. It uses the modification to enhance social engineering and make it more likely you could get someone to decrypt a message and then return the decrypted message to them: * https://www.schneier.com/academic/archives/2000/08/a_chosen_ciphertext.html https://www.schneier.com/academic/archives/2000/08/a_chosen_... EFAIL is a poor example of this sort of thing. EFAIL was based on the information leak from HTML emails. The malleable encryption angle was quite forced: * https://articles.59.ca/doku.php?id=pgpfan:efail https://articles.59.ca/doku.php?id=pgpfan:efail In an email context a missing signature or a signature from someone you do not know counts as an invalid signature. A signature does in fact detect both of these to the extent that authenticated encryption could. >Errors on decrypting or parsing induced by mutations can then be used to get the plaintext. That sort of oracle attack can't really work in practice with a one way medium like email.

kerng 6y ago

Isn't that why HMAC exists?

upofadown 6y ago

This is the best example of an attack against PGP encryption malleability that I have come across. It uses the modification to enhance social engineering and make it more likely you could get someone to decrypt a message and then return the decrypted message to them: * https://www.schneier.com/academic/archives/2000/08/a_chosen_ciphertext.html https://www.schneier.com/academic/archives/2000/08/a_chosen_... EFAIL is a poor example of this sort of thing. EFAIL was based on the information leak from HTML emails. The malleable encryption angle was quite forced: * https://articles.59.ca/doku.php?id=pgpfan:efail https://articles.59.ca/doku.php?id=pgpfan:efail In an email context a missing signature or a signature from someone you do not know counts as an invalid signature. A signature does in fact detect both of these to the extent that authenticated encryption could. >Errors on decrypting or parsing induced by mutations can then be used to get the plaintext. That sort of oracle attack can't really work in practice with a one way medium like email.