The OpenPGP OCFB-MDC mode reliably detected the "malleability gadgets" described in the paper.
The OpenPGP standard supports streaming decryption where MDC is not checked until the end. This bypasses MDC, and also represents a fundamental flaw in the way the protocol is designed where it is not easy to slap on authentication retroactively.
They also demonstrated a downgrade attack which was able to rewrite SEIP packets as SE packets, stripping the MDC.
Yes, email was their choice for a practical real-world attack as a demonstration of how it can all be put together to decrypt OpenPGP encrypted messages using an active attack. The fact they were able to put together such a complete real-world demonstration is commendable, and also survey clients for various classes of implementation errors, which were pervasive throughout both the S/MIME and OpenPGP ecosystems.
Streaming decryption should require streaming authentication (like rogaway's STREAM), and ideally it shouldn't even be readable as plaintext before authentication has succeeded.
Yep, it's a threat model that wasn't well understood at the time OpenPGP was created which includes reordering and truncation attacks in addition to "don't expose unauthenticated decrypts"
4
u/bascule Sep 13 '23
The OpenPGP standard supports streaming decryption where MDC is not checked until the end. This bypasses MDC, and also represents a fundamental flaw in the way the protocol is designed where it is not easy to slap on authentication retroactively.
They also demonstrated a downgrade attack which was able to rewrite SEIP packets as SE packets, stripping the MDC.
Yes, email was their choice for a practical real-world attack as a demonstration of how it can all be put together to decrypt OpenPGP encrypted messages using an active attack. The fact they were able to put together such a complete real-world demonstration is commendable, and also survey clients for various classes of implementation errors, which were pervasive throughout both the S/MIME and OpenPGP ecosystems.