>...PGP doesn't prescribe any particularly algorithm for these operations, so PGP implementations are potentially susceptible to these issues. OpenPGP and impl

>...PGP doesn't prescribe any particularly algorithm for these operations, so PGP implementations are potentially susceptible to these issues. OpenPGP and implementations get a fair bit of academic scrutiny. The published PGP standard refers to RFC3447 which is PKCS #1 v2.1 for RSA. It is quite unlikely that there are any bonehead errors in any of the popular implementations. >The most trivial one is the 1×1 tracking pixel that phones home, which is pretty common in email for tracking purposes. I think it was clear from context that I did not mean that no reverse channels existing anywhere, only in a form suitable for oracle attacks. The HTML image thing is a straight up leak that has actually been used to exfiltrate decrypted plaintext. >PGP is already decently well-known as being a bad cryptosystem... That isn't really true. It is actually one of the solidest cryptographic protocols ever. >...do not naïvely compose. What does that mean?