11 ms·

> Sure, but malleability that has a close to zero chance of being a problem. https://efail.de https://efail.de https://tonyarcieri.com/all-the-crypto-code-you

> Sure, but malleability that has a close to zero chance of being a problem. https://efail.de https://efail.de https://tonyarcieri.com/all-the-crypto-code-youve-ever-written-is-probably-broken https://tonyarcieri.com/all-the-crypto-code-youve-ever-writt... This isn't even a controversy among cryptographers or cryptography engineers.

upofadown 5y ago
Efail is an excellent example of how the static encryption of OpenPGP used for encrypted email makes malleability irrelevant. To make the Efail attack against OpenPGP work requires the knowledge of the first 11 bytes/characters of the unencrypted message. The attacker would only get one guess. The recipient by necessity would see the attack message and would immediately know there was something going on. As a result the Efail attack against the malleability of OpenPGP is completely impractical. Contrast the Efail situation with that of TLS. TLS allows almost unlimited secret trials against its cryptography by an attacker. There have been multiple practical attacks based on such oracles in TLS. >This isn't even a controversy among cryptographers or cryptography engineers. I would like to think that there were such people out there that understood that different techniques are applicable to different problems.
- pvg 5y ago
  the knowledge of the first 11 bytes/characters of the unencrypted message. You probably know how that worked out for the Enigma.
  - upofadown 5y ago
    I am not suggesting that email clients should entirely depend on OpenPGP email inherent resistance to oracle attacks, only pointing out that it exists. Presumably the Enigma operators were not putting their decrypted messages in envelopes before sending them off to their enemies. Efail was primarily a straight up plain text leak. Plain text attacks come in distinct categories. The block ciphers used in OpenPGP are generally considered to be immune to the sort of plain text attacks used against Enigma.
    - tptacek 5y ago
      I think when you're at the point in your argument where the bar you're setting is "immunity to the attacks that broke Enigma", you might as well just concede.
- espadrine 5y ago
  > The attacker would only get one guess As described in Efail, they don’t need to guess; they know the first 11 bytes with very, very high probability. I doubt me being able to read a third of your encrypted emails is remotely acceptable to you. > The recipient […] would see the attack message and would immediately know there was something going on. That solace is fleeting when it is already too late. The attacker has your decrypted message.
- tptacek 5y ago
  You can just read the Efail paper and see how faulty this argument is. Because PGP treats authenticated ciphers as a "cargo cult", the Efail team could plausibly have broken almost 40% of Facebook's PGP-encrypted password reset mails. Further: they were able to abuse MIME encoding to get multiple guesses per email. At any rate, none of this is something that anyone would accept from any modern cryptosystem, and the fact that PGP has you so backfooted that you'd feel the need to defend PGP's behavior here is a telling indication. "PGP: it's fine, as long as you don't use it to encrypt password reset emails. But for other emails it's fine, as long as the first 11 bytes of the email aren't guessable." Ok. Good note! Maybe we should just put 128-bit nonces at the tops of all our emails. That just seems like common sense good engineering practice.
  - upofadown 5y ago
    >Further: they were able to abuse MIME encoding to get multiple guesses per email. The paper did not provide any example of an email client where this would work. I have as of yet not been able to reproduce this. Since there would be no practical reason for such behaviour the assertion requires some sort of proof.

upofadown 5y ago

Efail is an excellent example of how the static encryption of OpenPGP used for encrypted email makes malleability irrelevant. To make the Efail attack against OpenPGP work requires the knowledge of the first 11 bytes/characters of the unencrypted message. The attacker would only get one guess. The recipient by necessity would see the attack message and would immediately know there was something going on. As a result the Efail attack against the malleability of OpenPGP is completely impractical. Contrast the Efail situation with that of TLS. TLS allows almost unlimited secret trials against its cryptography by an attacker. There have been multiple practical attacks based on such oracles in TLS. >This isn't even a controversy among cryptographers or cryptography engineers. I would like to think that there were such people out there that understood that different techniques are applicable to different problems.

pvg 5y ago
the knowledge of the first 11 bytes/characters of the unencrypted message. You probably know how that worked out for the Enigma.
- upofadown 5y ago
  I am not suggesting that email clients should entirely depend on OpenPGP email inherent resistance to oracle attacks, only pointing out that it exists. Presumably the Enigma operators were not putting their decrypted messages in envelopes before sending them off to their enemies. Efail was primarily a straight up plain text leak. Plain text attacks come in distinct categories. The block ciphers used in OpenPGP are generally considered to be immune to the sort of plain text attacks used against Enigma.
  - tptacek 5y ago
    I think when you're at the point in your argument where the bar you're setting is "immunity to the attacks that broke Enigma", you might as well just concede.
espadrine 5y ago
> The attacker would only get one guess As described in Efail, they don’t need to guess; they know the first 11 bytes with very, very high probability. I doubt me being able to read a third of your encrypted emails is remotely acceptable to you. > The recipient […] would see the attack message and would immediately know there was something going on. That solace is fleeting when it is already too late. The attacker has your decrypted message.
tptacek 5y ago
You can just read the Efail paper and see how faulty this argument is. Because PGP treats authenticated ciphers as a "cargo cult", the Efail team could plausibly have broken almost 40% of Facebook's PGP-encrypted password reset mails. Further: they were able to abuse MIME encoding to get multiple guesses per email. At any rate, none of this is something that anyone would accept from any modern cryptosystem, and the fact that PGP has you so backfooted that you'd feel the need to defend PGP's behavior here is a telling indication. "PGP: it's fine, as long as you don't use it to encrypt password reset emails. But for other emails it's fine, as long as the first 11 bytes of the email aren't guessable." Ok. Good note! Maybe we should just put 128-bit nonces at the tops of all our emails. That just seems like common sense good engineering practice.
- upofadown 5y ago
  >Further: they were able to abuse MIME encoding to get multiple guesses per email. The paper did not provide any example of an email client where this would work. I have as of yet not been able to reproduce this. Since there would be no practical reason for such behaviour the assertion requires some sort of proof.