Language Selection

English French German Italian Portuguese Spanish

Critical PGP Security Issue

Filed under
Security
  • Attention PGP Users: New Vulnerabilities Require You To Take Action Now

    A group of European security researchers have released a warning about a set of vulnerabilities affecting users of PGP and S/MIME. EFF has been in communication with the research team, and can confirm that these vulnerabilities pose an immediate risk to those using these tools for email communication, including the potential exposure of the contents of past messages.

    The full details will be published in a paper on Tuesday at 07:00 AM UTC (3:00 AM Eastern, midnight Pacific). In order to reduce the short-term risk, we and the researchers have agreed to warn the wider PGP user community in advance of its full publication.

    Our advice, which mirrors that of the researchers, is to immediately disable and/or uninstall tools that automatically decrypt PGP-encrypted email. Until the flaws described in the paper are more widely understood and fixed, users should arrange for the use of alternative end-to-end secure channels, such as Signal, and temporarily stop sending and especially reading PGP-encrypted email.

  • Disabling PGP in Thunderbird with Enigmail

Response from Werner Koch

Subject: Efail or OpenPGP is safer than S/MIME
Date: Mon, 14 May 2018 09:45:51 +0200
From: Werner Koch
To: gnupg-users@gnupg.org

Hi!

Some may have noticed that the EFF has warnings about the use of PGP out
which I consider pretty overblown. The GnuPG team was not contacted by
the researchers but I got access to version of the paper related to
KMail. It seems to be the complete paper with just the names of the
other MUAs redacted.

Given that the EFF suggests to deinstall GpgOL, we know tha it is not
vulnerable; see see https://dev.gnupg.org/T3714.).

Here is a response I wrote on the weekend to a reporter who inquired on
this problem.

=============
The topic of that paper is that HTML is used as a back channel to create
an oracle for modified encrypted mails. It is long known that HTML
mails and in particular external links like
are evil if the MUA actually honors them (which many meanwhile seem to
do again; see all these newsletters). Due to broken MIME parsers a
bunch of MUAs seem to concatenate decrypted HTML mime parts which makes
it easy to plant such HTML snippets.

There are two ways to mitigate this attack

- Don't use HTML mails. Or if you really need to read them use a
proper MIME parser and disallow any access to external links.

- Use authenticated encryption.

The latter is actually easy for OpenPGP because we started to use
authenticated encryption (AE) since 2000 or 2001. Our AE is called MDC
(Modification detection code) and was back then introduced for a very
similar attack. Unfortunately some OpenPGP implementations were late to
introduce MDC and thus GPG could not fail hard on receiving a mail
without an MDC. However, an error is returned during decrypting and no
MDC is used:

gpg: encrypted with 256-bit ECDH key, ID 7F3B7ED4319BCCA8, created 2017-01-01
"Werner Koch "
[GNUPG:] BEGIN_DECRYPTION
[GNUPG:] DECRYPTION_INFO 0 7
[GNUPG:] PLAINTEXT 62 1526109594 [GNUPG:] PLAINTEXT_LENGTH 69
There is more to life than increasing its speed.
-- Mahatma Gandhi
gpg: WARNING: message was not integrity protected
[GNUPG:] DECRYPTION_FAILED
[GNUPG:] END_DECRYPTION

When giving a filename on the command line an output file is even not
created. This can't be done in pipe mode because gpg allows to process
huge amounts of data. MUAs are advised to consider the DECRYPTION_FAILED
status code and not to show the data or at least use a proper way to
display the possible corrupted mail without creating an oracle and to
inform the user that the mail is fishy.

For S/MIME authenticated encryption is not used or implemented in
practice and thus there is no short term way to fix this in S/MIME
except for not using HTML mails.

The upshot of this is that OpenPGP messages are way better protected
against such kind of attacks than S/MIME messages. Unless, well, the
MUAs are correctly implemented and check error codes!

Shalom-Salam,

Werner

p.s.
Some cryptographers turn up their nose at the OpenPGP MDC which is an
ad-hoc AE mode from a time before AE received much research. However,
it does it job and protects reliable against this and other attacks.
The next OpenPGP revision will bring a real AE mode (EAX or OCB
depending on key preferences) which has other benefits (early detection
of corrupted messages, speed) but it will takes years before it will be
widely deployed and can can actually be used to create messages.

--
# Please read: Daniel Ellsberg - The Doomsday Machine #
Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.

Alarmist articles

Subject: Re: [Enigmail] FYI disable enigmail now
Date: Mon, 14 May 2018 03:14:12 -0400
From: Robert J. Hansen
Reply-To: Enigmail user discussion list
To: enigmail-users@enigmail.net

We saw a preview of that paper. It's under embargo so it would be
inappropriate for us to comment on it until it's released. It was also
inappropriate for the EFF to comment on it. You can expect us to have
an official statement on it once the paper is published.

I will say this is a tempest in a teapot. Patrick, Werner, and I have
all seen it. We are not in the least bit worried. We wish the EFF had
reached out to us before running with an alarmist article.

tl;dr: as always, please use the latest Enigmail version, and do so with
confidence.

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

More in Tux Machines

Android Low-Memory Killer--In or Out?

One of the jobs of the Linux kernel—and all operating system kernels—is to manage the resources available to the system. When those resources get used up, what should it do? If the resource is RAM, there's not much choice. It's not feasible to take over the behavior of any piece of user software, understand what that software does, and make it more memory-efficient. Instead, the kernel has very little choice but to try to identify the software that is most responsible for using up the system's RAM and kill that process. The official kernel does this with its OOM (out-of-memory) killer. But, Linux descendants like Android want a little more—they want to perform a similar form of garbage collection, but while the system is still fully responsive. They want a low-memory killer that doesn't wait until the last possible moment to terminate an app. The unspoken assumption is that phone apps are not so likely to run crucial systems like heart-lung machines or nuclear fusion reactors, so one running process (more or less) doesn't really matter on an Android machine. Read more

today's leftovers

Security Leftovers

  • Microsoft & Pentagon are quietly hijacking US elections (by Lee Camp)
    Good news, folks! We have found the answer to the American rigged and rotten election system. The most trustworthy of corporations recently announced it is going to selflessly and patriotically secure our elections. It’s a small company run by vegans and powered by love. It goes by the name “Microsoft.” (You’re forgiven for never having heard of it.) The recent headlines were grandiose and thrilling: “Microsoft offers software tools to secure elections.” “Microsoft aims to modernize and secure voting with ElectionGuard.” Could anything be safer than software christened “ElectionGuard™”?! It has “guard” right there in the name. It’s as strong and trustworthy as the little-known Crotch Guard™ – an actual oil meant to be sprayed on one’s junk. I’m unclear as to why one sprays it on one’s junk, but perhaps it’s to secure your erections? (Because they’ve been micro-soft?)
  • Netflix Researchers Just Fixed 4 Severe Linux And FreeBSD Vulnerabilities
  • Netflix Uncovers TCP Bugs Within The Linux & FreeBSD Kernels
    As Netflix's first security bulletin for 2019, they warned of TCP-based remote denial of service vulnerabilities affecting both Linux and FreeBSD. These vulnerabilities are rated "critical" but already being corrected within the latest Git code.

Games: Project Zero Deaths, Littlewood, Ravenfield, ENCODYA

  • Project Zero Deaths, a new free to play online platform shooter has Linux support
    A free game to start the day with, as the multiplayer platform shooter Project Zero Deaths recently entered Early Access and it includes Linux support.
  • The peaceful building RPG 'Littlewood' is now available in Early Access with Linux same-day support
    Littlewood from developer Sean Young arrived on Steam in Early Access today and it looks like a very promising and peaceful RPG. Funded thanks to the help of nearly four thousand people on Kickstarter, Littlewood is set after the world has been saved and you're the hero tasked with rebuilding a town.
  • Ravenfield, the fun single-player FPS now has a built-in map editor and destructible object support
    The amount of content being added into Ravenfield is quite impressive and now anyone can easily make their own maps for it, without the need of Unity. Early Access Build 16 went live recently, with a custom-made map editor that works on Linux and it's surprisingly easy to use. You no longer need the Ravenfield mod tools for Unity, making it far more accessible. It comes with all of the official Ravenfield props, meaning you can place down all sorts of things. When ready, it also has Steam Workshop support built in for you to publish it.
  • Science Fiction point-and-click Encodya has a demo released, will go to Kickstarter
    The background story of the upcoming science fiction point and click game Encodya is the Kickstarter campaign for the animation short movie Robot Will Protect You. Getting over 23.000€ from an initial target of 8.750€, it reached several stretch goals, the last one being "We'll start developing a game!". And so they did... The game, named "ENCODYA", grabbed my attention in a Facebook group about point and click adventures. Drawn by the art, I asked if a Linux version would be possible. Indeed it was, and I was asked if I could test it. As it's using Unity, I expected it to a) fail on trying to play a video, b) show graphical problems or c) just run like the Windows version. First a) it was. But the author was eager to make the Linux version and a fix was attempted. After struggling with finding the right output options for the studio's intro video, we found that everything seems to be working just like on Windows. So Hooray for the game engines supporting the OS of our choice!