Subject: Re: Anybody know details about Schneier's "flaw"?

From: "Dominikus Scherkl" <[email-masked]>
Date: Mon, 19 Aug 2002 11:49:23 +0200

> Y'know, there's an even simpler attack with the same premise.  You
> intercept an encrypted e-mail from Alice to Bob.  You take the mail
> body out of the message and send that body to Bob under your e-mail
> address (or under some address you control that Bob might mistake for
> Alice's, which would be even better).  Bob decrypts the message and
> replies to it, including the original message body by default.
> 
> The mistake here, on Bob's part, is to reply to a message without
> paying attention to the e-mail address being used
The Flaw I see (on the whole attack) is:
Why should anybody relpy cleartext to an encrypted messge?
especialy if it contains (even parts) of the encrypted message?
And if anybody does, why he's using encryption at all?!?

If a reply is sent at all, it should be encrypted, so an interceptor
has the same problem with the reply - he needs to break the key.

And if it's the sender himself who want's to cheat him, he knows
the message content very well, so what does he want to gain?!?

The whole attack looks very suspicious to me...

-- 
Dominikus Scherkl
[email-masked]

---

From: "Adrian 'Dagurashibanipal' von Bidder" <[email-masked]>
Date: 19 Aug 2002 13:34:46 +0200

[please leave attribution in when replying]

> > paying attention to the e-mail address being used
[...]

> The whole attack looks very suspicious to me...

I guess the correct 'solution' to prevent the 'attack' would be to file
bug reports with gpg-aware mail clients that do not at least display a
warning when replying to/forwarding an originally encrypted message
unencrypted.

cheers
-- vbi

-- 
secure email with gpg                         http://fortytwo.ch/gpg

---

From: Werner Koch <[email-masked]>
Date: Mon, 19 Aug 2002 13:59:10 +0200

> especialy if it contains (even parts) of the encrypted message?

You will often notice plaintext message like "I could not decrypt your
message - please use key 0x12345678" or "Where do I find your key".
So it is not unlikely to see a message "Hey, your encrypted mail was
garbled, please send it again.  Here is the problematic line..".

Most users don't know about the cryptograhic issues involved in
sending parts of the plaintext back.  A good MUA should protect
against that but well a user can always override it.

> has the same problem with the reply - he needs to break the key.

I am probably not the only one with this problem: Try to get my key
from a keyserver - it is probably not usable because the subkeys are
all garbled (Most people don't look at the mail header X-Request-PGP
to find out the canonical way to get my key).  So it is very likely to
get a plaintext response; users are thus used to that and they can't
imagine what serious consequences a reply with a very short and after
all unreadable quote should have.

All over the place OpenPGP is rightfully very paranoid and thus it
makes sense to do what we can to avoid shoot-your-self-in-the-foot
traps.

Salam-Shalom,

   Werner

---

From: David Hopwood <[email-masked]>
Date: Mon, 19 Aug 2002 18:36:19 +0000

-----BEGIN PGP SIGNED MESSAGE-----

Dominikus Scherkl wrote:
> Carl Ellison <[email-masked]> wrote:

In that case Bob sees the original message, and at least has the possibility
of noting that it is not consistent with the reply-to address. If he sees
garbage, that could be consistent with any reply-to address, unless Bob
knows about this attack.

This is all part of the same problem that has been pointed out before in
the context of signing: the message content and the headers (including
the reply-to address and hence the public key to be used to encrypt replies),
are not treated as a unit cryptographically.

> Why should anybody reply cleartext to an encrypted message?

The attack does not depend on the victim replying in cleartext.
If the message is encrypted, it would be encrypted to the attacker's key.

Peter Gutmann wrote:
> On the grand scale of things, it has curiosity value, but not much more.  There
> are a pile of other attacks which fall into the same class, e.g. concern over
> the Bleichenbacher attack on SSL being used against S/MIME email (come to think
> of it, that one never came up on open-pgp).  My thoughts on this at the time,
> which also apply to this attack, were:
> 
> -- Snip --
> 
>   [...] this attack requires that an attacker send you around a million pieces
>   of CMS encrypted email with attached receipt requests, that you respond with
>   a million receipts indicating to the attacker the exact details of why the
>   decrypt failed, that you reuse the same per-message key for each of those
>   million messages.

What on earth does this attack have to do with sending millions of messages?
It requires one message, and is considerably more plausible than applying the
Bleichenbacher attack to email (or would be, if it is wasn't prevented in
practice by compression).

- -- 
David Hopwood <[email-masked]>

Home page & PGP public key: http://www.users.zetnet.co.uk/hopwood/
RSA 2048-bit; fingerprint 71 8E A6 23 0E D3 4C E5  0F 69 8C D4 FA 66 15 01
Nothing in this message is intended to be legally binding. If I revoke a
public key but refuse to specify why, it is because the private key has been
seized under the Regulation of Investigatory Powers Act; see www.fipr.org/rip