2 ms·

Your example seems overly dramatic to the point of being completely unbelievable. Can you provide some reference links or other further reading? How does an att

Your example seems overly dramatic to the point of being completely unbelievable. Can you provide some reference links or other further reading? How does an attacker change the complete text in a meaningful without knowing Bobs private key?

tialaramex 5y ago
Essentially, all modern symmetric encryption works by XORing something an attacker can't know with the plaintext to form a ciphertext. The recipient does the reverse operation to turn ciphertext back into plaintext. So it's actually very simple to change what it says, without knowing the key, if you know what it says now. For example, XOR the old known message with your replacement to get a stream A, then you XOR the current ciphertext with A to get a new ciphertext, which will be decrypted to give your replacement message. [Edited: I re-read this and I've oversold it substantially. In practice you won't have this easy a time with a non-toy system. But some of the cipher modes PGP still routinely uses will make it almost this easy if the attacker knows what they're doing and has the entire message text] What a modern system does here is it uses an "Authenticated Encryption" mode where the ciphertext is slightly larger such that decrypting also ends up calculating a "tag" value that should match one carried in the message. If the message was altered that tag won't match, and crucially there just is no plaintext in this case. If you have a halfway modern web browser, the secured connection to Hacker News does exactly this, so an on-path attacker can't change anything going back and forth, the most they can do is blow up your connection. But nobody was doing that when PGP was originally invented. So at first what PGP does is it relies on digital signatures over the entire message. After processing the entire message apparently from Bob, PGP sees that it has a signature, and this signature fails - this isn't the message Bob signed. Bad guys (who know the message but not the keys) can't prevent that. But it turns out that in practice they needn't care. The (bogus) decrypted plaintext is shown to Alice first, and Alice will have likely seen messages with "failed" signatures before, and she knows it's probably some stupid mail server configuration issue or something else unimportant. This message from Bob decrypted as expected, so what's the problem? Now you know what the problem is, I explained it above, but Alice almost certainly doesn't, as you didn't when you replied. It seems crazy that an "encrypted" message could be altered so easily, who would design it that way? More modern versions of (Open)PGP introduce this thing called MDC, which makes it at least possible to think about whether this tampering has happened to the raw encryption, without signatures, however for ages the default behaviour was still to just warn the user that there's a problem after showing them the bogus plaintext. In current versions this isn't what will happen with raw GnuPG itself out of the box, except there are still lots of caveats (e.g. Unix pipes defeat this) and so in practical use you often end up back with the user being shown the bogus plaintext anyway.

tialaramex 5y ago

Essentially, all modern symmetric encryption works by XORing something an attacker can't know with the plaintext to form a ciphertext. The recipient does the reverse operation to turn ciphertext back into plaintext. So it's actually very simple to change what it says, without knowing the key, if you know what it says now. For example, XOR the old known message with your replacement to get a stream A, then you XOR the current ciphertext with A to get a new ciphertext, which will be decrypted to give your replacement message. [Edited: I re-read this and I've oversold it substantially. In practice you won't have this easy a time with a non-toy system. But some of the cipher modes PGP still routinely uses will make it almost this easy if the attacker knows what they're doing and has the entire message text] What a modern system does here is it uses an "Authenticated Encryption" mode where the ciphertext is slightly larger such that decrypting also ends up calculating a "tag" value that should match one carried in the message. If the message was altered that tag won't match, and crucially there just is no plaintext in this case. If you have a halfway modern web browser, the secured connection to Hacker News does exactly this, so an on-path attacker can't change anything going back and forth, the most they can do is blow up your connection. But nobody was doing that when PGP was originally invented. So at first what PGP does is it relies on digital signatures over the entire message. After processing the entire message apparently from Bob, PGP sees that it has a signature, and this signature fails - this isn't the message Bob signed. Bad guys (who know the message but not the keys) can't prevent that. But it turns out that in practice they needn't care. The (bogus) decrypted plaintext is shown to Alice first, and Alice will have likely seen messages with "failed" signatures before, and she knows it's probably some stupid mail server configuration issue or something else unimportant. This message from Bob decrypted as expected, so what's the problem? Now you know what the problem is, I explained it above, but Alice almost certainly doesn't, as you didn't when you replied. It seems crazy that an "encrypted" message could be altered so easily, who would design it that way? More modern versions of (Open)PGP introduce this thing called MDC, which makes it at least possible to think about whether this tampering has happened to the raw encryption, without signatures, however for ages the default behaviour was still to just warn the user that there's a problem after showing them the bogus plaintext. In current versions this isn't what will happen with raw GnuPG itself out of the box, except there are still lots of caveats (e.g. Unix pipes defeat this) and so in practical use you often end up back with the user being shown the bogus plaintext anyway.