Subject: Re: Anybody know details about Schneier's "flaw"?

From: [email-masked] (Peter Gutmann)
Date: Mon, 19 Aug 2002 23:29:30 +1200 (NZST)

"Dominikus Scherkl" <[email-masked]> writes:

>The whole attack looks very suspicious to me...

On the grand scale of things, it has curiosity value, but not much more.  There
are a pile of other attacks which fall into the same class, e.g. concern over
the Bleichenbacher attack on SSL being used against S/MIME email (come to think
of it, that one never came up on open-pgp).  My thoughts on this at the time,
which also apply to this attack, were:

-- Snip --

  [...] this attack requires that an attacker send you around a million pieces
  of CMS encrypted email with attached receipt requests, that you respond with
  a million receipts indicating to the attacker the exact details of why the
  decrypt failed, that you reuse the same per-message key for each of those
  million messages.

  Now maybe I'm being a bit optimistic here, but I do think that claiming this
  is a weakness is a pretty silly.  First of all you need to assume that an
  attacker can somehow send you a million pieces of email without you noticing
  and without it getting stopped by spam blockers.  Your own software then has
  to try to decrypt each of the one million pieces of email, find that it
  can't, and send out a receipt to the sender containing an indication of
  exactly how the decryption failed (this isn't possible even if you wanted to
  do it, although who knows what the Receipt Notification WG have been working
  on recently).  Finally, the whole attack only works if you reuse
  cryptovariables.  This is why the CERT advisory on this problem specifically
  points out "This vulnerability does not affect S/MIME or SET".

  As a security threat, I'd say this rates somewhere down with "Router hit by
  meteorite", "Computer trampled by stampeding water buffalo", "Hard drive
  kidnapped by space aliens", and similar stuff.

Sure, it is in theory possible, if you try really, really hard and are willing
to bend over backwards to cooperate with an attacker, to allow this kind of
attack to occur.  [...]  You're more likely to get someone's key by asking them
for it (I've seen this happen a number of times, in some cases without even
needing to ask for it, by people who assume that "PKCS #12 == certificate" and
send out their "certificate" for others to use) than by using this kind of
attack.

Just because it's (theoretically) possible to break into Fort Knox with a can
opener doesn't mean that Kentucky is going to start screening people at the
border for possession of said item.

-- Snip --

A better way of putting that last sentence is given in one of my favourite
computing quotes, by Chris Strachey:

  "The fact that it's possible to push a pea up a mountain with your nose
   doesn't mean that this is a sensible way of getting it there".

Peter.

---

From: "Adrian 'Dagurashibanipal' von Bidder" <[email-masked]>
Date: 19 Aug 2002 14:54:18 +0200

> On the grand scale of things, it has curiosity value, but not much more.  There
[...]

> attack to occur.  [...]  You're more likely to get someone's key by asking them

As I've said in my other mail it's really a problem of some mailreaders
being unclear. For example, evolution does not display any indication
that the displayed message was encrypted. (You have to enter the
passphrase the first time you look at an encrypted msg, but I usually
tell it to store the passphrase for the session, causing it to
auto-decrypt any further messages.

In other words: on technical grounds, I absolutely agree with you. BUT
with bad UIs in some mailreaders, and with the experience that users
generally are more stupid than anyone would believe, this type of attack
is very realistic.

Bot, and here I'm sure that your opinion is the same, this discussion is
not really on-topic on a technical mailing list... 

cheers
-- vbi

-- 
secure email with gpg                         http://fortytwo.ch/gpg