Spoofing OpenPGP.js signature verification
codeanlabs.com
Spoofing OpenPGP.js signature verification
1–10 of 32 posts
Re: Spoofing OpenPGP.js signature verification
#2Another year, another critical parsing vulnerability in the PGP ecosystem. Latacora has an excellent post[1] that touches on the excessive complexity of PGP's encoding which, remarkably, probably isn't even in the top 3 things wrong with PGP.
My personal favorite of these is when someone sent a weaponized compression packet to oss-sec in 2022[2].
[1]: https://www.latacora.com/blog/2019/07/16/the-pgp-problem/
Re: Spoofing OpenPGP.js signature verification
#3This is not normal. Modern cryptosystems don't have anything like PGP's insane "packet" format, which has caused other problems before this. There's no principal of design that would lead you to what PGP came up with, and the only reason we still have to deal with it is path dependence. I don't even care if you call the next design "PGP2", just throw this system in the bin and start over.
Re: Spoofing OpenPGP.js signature verification
#4Another year, another critical parsing vulnerability in the PGP ecosystem. Latacora has an excellent post[1] that touches on the excessive complexity of PGP's encoding which, remarkably, probably isn't even in the top 3 things wrong with PGP. My personal favorite of these is when someone sent a weaponized compression packet to oss-sec in 2022[2]. [1]: https://www.latacora.com/blog/2019/07/16/the-pgp-problem/ [2]: htt…
To save typing, I came up with a commentary on "The PGP Problem":
* https://articles.59.ca/doku.php?id=pgpfan:tpp
The complaint about excessive complexity was about the packet length representation. That isn't a really great example. The PGP packet length representation is fairly straightforward.
Re: Spoofing OpenPGP.js signature verification
#5Another year, another critical parsing vulnerability in the PGP ecosystem. Latacora has an excellent post[1] that touches on the excessive complexity of PGP's encoding which, remarkably, probably isn't even in the top 3 things wrong with PGP. My personal favorite of these is when someone sent a weaponized compression packet to oss-sec in 2022[2]. [1]: https://www.latacora.com/blog/2019/07/16/the-pgp-problem/ [2]: htt…
To save typing, I came up with a commentary on "The PGP Problem": * https://articles.59.ca/doku.php?id=pgpfan:tpp The complaint about excessive complexity was about the packet length representation. That isn't a really great example. The PGP packet length representation is fairly straightforward.
You are writing this comment on a story where that packet format literally created a signature bypass vulnerability. Tell us more about how straightforward it is?
Re: Spoofing OpenPGP.js signature verification
#6Another year, another critical parsing vulnerability in the PGP ecosystem. Latacora has an excellent post[1] that touches on the excessive complexity of PGP's encoding which, remarkably, probably isn't even in the top 3 things wrong with PGP. My personal favorite of these is when someone sent a weaponized compression packet to oss-sec in 2022[2]. [1]: https://www.latacora.com/blog/2019/07/16/the-pgp-problem/ [2]: htt…
To save typing, I came up with a commentary on "The PGP Problem": * https://articles.59.ca/doku.php?id=pgpfan:tpp The complaint about excessive complexity was about the packet length representation. That isn't a really great example. The PGP packet length representation is fairly straightforward.
You've linked this commentary in just about every PGP thread I've seen on HN, but the vulnerabilities keep coming. I don't think a dynamic TLV encoding was defensible a decade ago, and it certainly isn't defensible in 2025.
(As the Latacora post points out, this is the same essential error that cryptographic applications of BER make. The difference is that serious users of ASN.1 have mostly sobered up and switched to DER; no such sobering has happened in the PGP ecosystem.)
Re: Spoofing OpenPGP.js signature verification
#7Earlier quoted context omitted.
To save typing, I came up with a commentary on "The PGP Problem": * https://articles.59.ca/doku.php?id=pgpfan:tpp The complaint about excessive complexity was about the packet length representation. That isn't a really great example. The PGP packet length representation is fairly straightforward.
You are writing this comment on a story where that packet format literally created a signature bypass vulnerability. Tell us more about how straightforward it is?
The issue discovered in TFA isn't about the format of individual packets (which "The PGP Problem" laments) but the grammar above the packets, i.e. the correct ordering of valid packets.
Edit: foot successfully inserted in mouth
Re: Spoofing OpenPGP.js signature verification
#8Earlier quoted context omitted.
You are writing this comment on a story where that packet format literally created a signature bypass vulnerability. Tell us more about how straightforward it is?
The issue discovered in TFA isn't about the format of individual packets (which "The PGP Problem" laments) but the grammar above the packets, i.e. the correct ordering of valid packets. Edit: foot successfully inserted in mouth
An absence of a canonical order or a definition of a well-formed packet sequence is itself a flaw in the packet format. Other cryptographic serialization and encoding schemes do not make this mistake.
Re: Spoofing OpenPGP.js signature verification
#9Earlier quoted context omitted.
You are writing this comment on a story where that packet format literally created a signature bypass vulnerability. Tell us more about how straightforward it is?
The issue discovered in TFA isn't about the format of individual packets (which "The PGP Problem" laments) but the grammar above the packets, i.e. the correct ordering of valid packets. Edit: foot successfully inserted in mouth
I wrote the "PGP Problem" article and definitely was not just talking about "the format of individual packets", which you might be able to tell from the fact that it brings up a quadratic parsing DoS in that design as well.
Re: Spoofing OpenPGP.js signature verification
#10Earlier quoted context omitted.
The issue discovered in TFA isn't about the format of individual packets (which "The PGP Problem" laments) but the grammar above the packets, i.e. the correct ordering of valid packets. Edit: foot successfully inserted in mouth
I wrote the "PGP Problem" article and definitely was not just talking about "the format of individual packets", which you might be able to tell from the fact that it brings up a quadratic parsing DoS in that design as well.
Since you are the author of TPP could you please explain how your example shows some sort of quadratic parsing DOS? I don't see anything like that. Just a huge number of signatures.