3 ms·
[MS-OXORMMS] reuses cryptography from [MS-RMPR] as the offending 15 year old specification that allows ECB to be used (as well as padded and unpadded CBC) for e
by dhx 4y ago
[MS-OXORMMS] reuses cryptography from [MS-RMPR] as the offending 15 year old specification that allows ECB to be used (as well as padded and unpadded CBC) for encrypting the content blob within the message.rpmsg attachment to "protected e-mails". As the original article states, Microsoft have kept using ECB for backwards compatibility with their 13 year old product Office 2010 that reached end of life 2 years ago (Oct 2020)[1].
Despite all the talk about "Purview Advanced Message Encryption" replacing whatever came before it, a recent demonstration[2] shows attachments labelled "message_v4.rpmsg"[3] and "message_v3.rpmsg"[4] being sent to an external Gmail recipient so it appears [MS-OXORMMS]/[MS-RMPR] are still being relied upon but perhaps the server part of [MS-RMPR] is now only implemented by Azure and has no on-premises implementation?
In one of the examples[4], the "Purview Advanced Message Encryption" feature allows "message_v3.rpmsg" to be sent as an attachment to an external recipient that then doesn't have permission to view the e-mail. Why send an encrypted message to someone that is meant to have no means to decrypt it?
[MS-OXORMMS] https://interoperability.blob.core.windows.net/files/MS-OXORMMS/%5BMS-OXORMMS%5D.pdf#page=23 https://interoperability.blob.core.windows.net/files/MS-OXOR...
[MS-RMPR] https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-RMPR/[MS-RMPR].pdf#page=35 https://winprotocoldoc.blob.core.windows.net/productionwindo...
[1] https://support.microsoft.com/en-us/office/end-of-support-for-office-2010-3a3e45de-51ac-4944-b2ba-c2e415432789 https://support.microsoft.com/en-us/office/end-of-support-fo...
[2] https://youtu.be/9NydrGVG_mI?t=164 https://youtu.be/9NydrGVG_mI?t=164
[3] https://youtu.be/9NydrGVG_mI?t=273 https://youtu.be/9NydrGVG_mI?t=273
[4] https://youtu.be/9NydrGVG_mI?t=452 https://youtu.be/9NydrGVG_mI?t=452