Subject: Re: secure sign & encrypt

From: [email-masked]
Date: Thu, 23 May 2002 17:04:48 +0200

vedaal wrote:
> ----- Original Message -----
> From: "Terje Braaten" <[email-masked]>
> Sent: Monday, May 20, 2002 7:31 PM
> Subject: RE: secure sign & encrypt
> 
> [...]
> 
>  > The problem is that most users when they decrypt a message
> > that is signed, they will think they can be sure the signer
> > and the encrypter is the same person/entity.
> > It would be a major improvement in the OpenPGP specification
> > to allow applications to ensure that that really is the case.
> 
> [...]
> 
> Functionally, that is the case now in Open PGP.
> 
> Even though a signed and encrypted message can be separated into a
> verifiable free standing signed message, and then
> re-encrypted and sent on to someone else,
> it 'cannot' {afaik} be re-combined into a signed and encrypted message that
> appears the same as a de-novo signed and encrypted message.

it can be done.
it's even not necessary to fully decrypt the message,
one can just decrypt only pubkey encryption to get session key,
then encrypt this session key to other pubkey!

what bothering me more is that fake pubkey encryption packets can be added
by man in the middle so that recipient thinks that message was encrypted
to him and to other preson.

I wrote about it here:
http://lists.gnupg.org/pipermail/gnupg-devel/2001-August/006285.html

__
Disastry  http://disastry.dhs.org/
http://disastry.dhs.org/pgp <----PGP plugins for Netscape and MDaemon
 ^----PGP 2.6.3ia-multi06 (supports IDEA, CAST5, BLOWFISH, TWOFISH,
      AES, 3DES ciphers and MD5, SHA1, RIPEMD160, SHA2 hashes)

---

From: [email-masked]
Date: Thu, 23 May 2002 19:26:05 +0200

disastry wrote:
> fake pubkey encryption packets can be added

I think this can be solved by modifying
Sym. Encrypted Integrity Protected Data Packet (Tag 18).

Now it is:

version byte == 1
encrypted data

encrypted data consists of:
  encrypted iv
  encrypted plaintext
  encrypted Modification Detection Code Packet (Tag 19)

I suggest:

version byte == 2
encrypted data

encrypted data consists of:
  encrypted iv
  encrypted Recipients packet (Tag 20)
    (put it before plaintext - if it would be after it would
     be difficult to find where plaintext ends, when decrypting)
  encrypted plaintext
  encrypted Modification Detection Code Packet (Tag 19)

Recipients packet
  version byte == 1
  number of recipients, 2 bytes (should be enough..)
  number_of_recipients*20 byte list of fingerprints recipient keys
    (16 byte RSA v3 key fingerprints are appended with 4 zeros
     (or maybe with 4 lowest keyid bytes? I think, it's even better))

this ensures that recipient list is intact not only for signed & encrypted messages
but also for encrypted only messages.

__

---

From: Derek Atkins <[email-masked]>
Date: 23 May 2002 14:47:27 -0400

This doesn't help.  Any recipient could re-encrypt the message and
change the list of encrypted recipients.

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available