OpenPGP SEIP downgrade attack

#1

Post by mukyu » Thu, Oct 08, 2015, 1:09 PM UTC

OpenPGP SEIP downgrade attack
metzdowd.com

Re: OpenPGP SEIP downgrade attack

#2

Post by tptacek » Thu, Oct 08, 2015, 1:39 PM UTC

The flaw he appears to be talking about is that the OpenPGP MDC doesn't cover metadata; the message must be parsed to recover the authenticator before the authenticator can be checked, and so the ciphertext is malleable.

The properties he's talking about for CFB are largely true of CTR as well (the gold standard in streaming modes). I think, by suggesting PGP use a "different mode", he may instead mean it would be better if PGP used an authenticated encryption mode.

Authentication is a weak spot for PGP, since its design predates much of authenticated cryptography.

Re: OpenPGP SEIP downgrade attack

#3

Post by adrianN » Thu, Oct 08, 2015, 1:53 PM UTC

So the message is: don't trust the integrity of encrypted mails unless the signature is valid? That doesn't seem too terrible.

Re: OpenPGP SEIP downgrade attack

#4

Post by throwaway7767 » Thu, Oct 08, 2015, 3:27 PM UTC

tptacek wrote: post #2

The flaw he appears to be talking about is that the OpenPGP MDC doesn't cover metadata; the message must be parsed to recover the authenticator before the authenticator can be checked, and so the ciphertext is malleable. The properties he's talking about for CFB are largely true of CTR as well (the gold standard in streaming modes). I think, by suggesting PGP use a "different mode", he may instead mean it would be be…

Indeed, further down the thread Werner Koch suggests the solution is deploying AEAD modes, but the bottleneck is other implementations picking it up.

As an aside, I'm surprised this got posted to cryptography@metzdowd, the S/N on that list is so low I'm surprised anyone still bothers to read it.

Re: OpenPGP SEIP downgrade attack

#5

Post by nickpsecurity » Thu, Oct 08, 2015, 4:08 PM UTC

GPG comes through again. Not ideally but acceptably for the paranoids. :)

Re: OpenPGP SEIP downgrade attack

#6

Post by nickpsecurity » Thu, Oct 08, 2015, 4:11 PM UTC

tptacek wrote: post #2

The flaw he appears to be talking about is that the OpenPGP MDC doesn't cover metadata; the message must be parsed to recover the authenticator before the authenticator can be checked, and so the ciphertext is malleable. The properties he's talking about for CFB are largely true of CTR as well (the gold standard in streaming modes). I think, by suggesting PGP use a "different mode", he may instead mean it would be be…

Thanks for the clear translation of the issue.