Subject: RE: secure sign & encrypt

From: Terje Braaten <[email-masked]>
Date: Thu, 23 May 2002 11:00:15 +0200

Derek Atkins <[email-masked]> writes:
> 
> You seem to be under the misconception that "sigh & enrypt" is an
> atomic PGP operation.  It is not.  There is "OpenPGP Sign" and there
> is "OpenPGP Encrypt", and these two functions _can_ be combined, but
> the combination is NOT a single atomic function.  It never was.

Well, I intended it to become an atomic function. Many users perceive it
today to be an atomic function, and I think it would be really nice
and a big improvement of the software if it really became a secure
atomic function.

> 
> All PGP ever had was "first sign and then encrypt".  It was just
> user-interface "syntactic sugar" that allows the user to perform both
> tasks together.  However, there is no way for a receiver to tell the
> difference between a one-pass and two-pass "sign and then encrypt".

That is what I see as a major weakness with PGP today. There should be
a difference, and the user should be able to be sure that the signer
and encrypter is the same person if atomic sign & encrypt is used.
It is both very user friendly to make it that way, and it will make
it more secure since it is a already a wide misconception that you
can tell the difference with the current implementation.

[snip]
> > But the point is not to make some human readable boilerplate. The
> > point is that OpenPGP software automatically should be able 
> to detect
> > if the message has been faked to look like it is created by
> > sign & encrypt when it really is not.
> 
> What do you mean?  Can you please explain what attack you believe
> you are preventing?

Alice makes a love poem, signs & encrypts it and sends it to Bob.
Some months later they have broken up with each other. Bob decides
to be mean to Alice, and encrypts the signed love poem and sends it
to Charlie, faking the From header in the mail so it look likes it is
from Alice. Then Charlie has a message that is encrypted to him and signed
by Alice. It seems to Charlie like it is created by sign & encrypt in
PGP, so he is convinced this must be a message from Alice that she
has encrypted specially for him.

What I would like is any PGP implementation to be able to display a message
like "Good signature from nn. Warning, this message is not made with atomic
sign & encrypt, and may be encrypted by some one else."

-- 
Terje Bråten

---

From: Matthew Byng-Maddick <[email-masked]>
Date: Thu, 23 May 2002 11:10:37 +0100

> sign & encrypt, and may be encrypted by some one else."

As others have pointed out, what is the "atomic sign & encrypt" of which you
speak?

MBM

-- 
Matthew Byng-Maddick         <[email-masked]>           http://colondot.net/

---

From: Derek Atkins <[email-masked]>
Date: 23 May 2002 08:32:08 -0400

> has encrypted specially for him.

Note that this will already say:

Good signature from Alic.
Signature made <Date three months ago>

Don't you think Charlie would be suspicious about that?  I would
certainly be suspicious if the signature date wasn't pretty close
to the mail date.  And I would also be suspicious if the mail date
wasn't close to "today".

> sign & encrypt, and may be encrypted by some one else."

You see, I view this just like regular mail.  There is the envelope
information, and there is the "letter".  By _CONVENTION_ the person
writing a letter duplicates the envelope information on the inside.
This is not done automatically by the Postal Service, nor is it done
automatically by the enveloping process.  A user could just as easily
leave that information out of the letter (thereby opening themselves
to this same attack in meatspace).

This is not something that should be solved at the Protocol Layer.
Repeat to yourself: IT IS A FEATURE THAT SIGN AND ENCRYPT ARE
SEPARABLE OPERATIONS.  Once you make that statement, there is no way,
short of layering violations, to do what you want to do except at the
application later duplicating the information.

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available