This is the best example of an attack against PGP encryption malleability that I have come across. It uses the modification to enhance social engineering and ma

This is the best example of an attack against PGP encryption malleability that I have come across. It uses the modification to enhance social engineering and make it more likely you could get someone to decrypt a message and then return the decrypted message to them: * https://www.schneier.com/academic/archives/2000/08/a_chosen_ciphertext.html https://www.schneier.com/academic/archives/2000/08/a_chosen_... EFAIL is a poor example of this sort of thing. EFAIL was based on the information leak from HTML emails. The malleable encryption angle was quite forced: * https://articles.59.ca/doku.php?id=pgpfan:efail https://articles.59.ca/doku.php?id=pgpfan:efail In an email context a missing signature or a signature from someone you do not know counts as an invalid signature. A signature does in fact detect both of these to the extent that authenticated encryption could. >Errors on decrypting or parsing induced by mutations can then be used to get the plaintext. That sort of oracle attack can't really work in practice with a one way medium like email.