Subject: RE: secure sign & encrypt

From: Terje Braaten <[email-masked]>
Date: Wed, 22 May 2002 20:07:41 +0200

> -----Original Message-----
> From: Hal Finney [mailto:[email-masked]]
> Sent: 22. May 2002 19:09
> To: [email-masked]; [email-masked]
> Subject: RE: secure sign & encrypt
> 
> 
> The problem is that this sign-and-encrypt issue is just the tip of
> the iceberg.  It is not worth redoing the protocol when there 
> are these
> other issues that will remain unresolved.

I disagree with this. The encryption of a message is much more
fundamentally linked to the signing of the same message, both in
practice and in peoples mind. Since we do have a function called
sign & encrypt in PGP, users will assume that it really is a secure
sign & encrypt, and that they can trust it to be one operation where
the signature and the encryption is linked.

Even more sophisticated users like f.ex. Vedaal on this list, seem to
think that already in PGP you can be sure that the signer is the same as
the encrypter if it appears that the message has been made by a PGP
sign & encrypt operation.

[snip]
> I read the paper and closely followed the extensive discussion on the
> cryptography list when this came out last year.  In my opinion the
> consensus among the professionals on that list was that, properly
> understood, there is more to this than a protocol flaw that can be
> easily patched.  It represents a fundamental property of 
> encrypted email.
> Some data is protected and some is not.

And I think we should make who the message is encrypted to a part
of what is protected, as long as PGP offers a function called sign &
encrypt.

> 
> The real solution is to put the entire email, headers and all, into
> the signed envelope, and then for the receiving software to compare
> the protected headers with those on the actual message.  This will
> detect substition of from/to lines as well as other changes, and will
> work for both signed and signed+encrypted messages.
> 
> We do have data structures to support this via PGP/MIME and the
> Message/rfc822 MIME type.  However actually implementing this
> functionality is difficult as it requires close integration with the
> email software.  In practice, probably only email software providers
> would be in a position to provide this level of functionality.

Yes, this is really an issue that should go into the PGP/MIME standard
as well, and there also protect important headers in the mail like
To, From, Cc, Date, etc.
But here we discuss the core OpenPGP standard, and since it includes
detailed specifications on how sign & encrypt is to be done,
this also should be fixed in this standard.

Also note that this problem is not specific to messages sent by e-mail,
but applies to all messages that is signed & encrypted and may not
naturally contain a To or From field.

-- 
Terje Bråten

---

From: Jon Callas <[email-masked]>
Date: Wed, 22 May 2002 12:09:47 -0700

Hal posted a pointer to my comments on this from last year. I'll weigh in
again.

I think this is an issue with semantics. You can't solve semantic problems
with added syntax, no matter how much syntax you add.

Furthermore, there are risks with this, too. You can still perform a
redirection attack on a targeted signature. Suppose Alice is trying to do a
business deal with both Bob and Charlie, and trying to get the best price.
If Bob sends Charlie a signed message that is targeted to him, it can be
more embarrassing than if the signature were untargeted. I'm really sorry,
but if you send a private message to someone who puts it on their web page,
you might be irked by this.

One of the things that I try to keep an eye out for is traffic analysis. I
think it is a feature of OpenPGP that it puts the signatures inside the
envelope, because if they're outside the envelope, you have
cryptographically assisted traffic analysis. Targeting in signatures also
assists traffic analysis, and users who don't understand that signing
low-context messages is a bad idea aren't going to understand traffic
analysis issues.

Lastly, if you really, really want to do this, there is already support in
the OpenPGP protocol for it! This is one of the myriad things notations are
good for. Software can make a signature with a human-readable notation in it
that is boilerplate. It could say, "Created on <date> by <source> for
<target>." There's your targeting, just convince some implementer to do it.
Just don't make me use it, thanks. I'll have even less reason to sign
things.

    Jon