Subject: Anybody know details about Schneier's "flaw"?

From: [email-masked]
Date: Wed, 14 Aug 2002 09:40:39 -0500

In http://netscape.com.com/2100-1105-949506.html?type=pt there is a vague 
mention of a problem:

Schneier released information Monday about a separate flaw in the PGP 
(Pretty Good Privacy) program that is freely available and used to encrypt 
messages sent over the Internet. 
Schneier and Jonathan Katz of the University of Maryland at College Park 
found a way an attacker could intercept a PGP encrypted message, modify it 
without decrypting it, dupe the user into sending it back, and retrieve 
the original message

Does anybody know more about this?  Can a minor improvement to the new 
-bis draft fix it?

--John

---

From: Derek Atkins <[email-masked]>
Date: 14 Aug 2002 10:50:21 -0400

> Does anybody know more about this?  Can a minor improvement to the new 

a) this only works if you do NOT compress your messages before you encrypt.
b) this only works if you do NOT sign the message AND you do NOT use an MDC

> --John

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available

---

From: Rodney Thayer <[email-masked]>
Date: Wed, 14 Aug 2002 09:34:03 -0700

I think it's got too many odd things in it to require compression.
Basically it's a "if you let yourself get social engineered then
your crypto can be used against you" attack.

---

From: Derek Atkins <[email-masked]>
Date: 14 Aug 2002 12:51:48 -0400

> I think it's got too many odd things in it to require compression.

Indeed.. As I said (perhaps incoherently), the attack only works if
you DO NOT compress.  If you compress the message then there is no way
to XOR against the message.

-derek

-- 
       Derek Atkins
       Computer and Internet Security Consultant
       [email-masked]             www.ihtfp.com

---

From: Marc Mutz <[email-masked]>
Date: Wed, 14 Aug 2002 22:42:09 +0200

On Wednesday 14 August 2002 16:40, [email-masked] wrote:
> In http://netscape.com.com/2100-1105-949506.html?type=pt there is a
> vague mention of a problem:
<snip>
> Does anybody know more about this?  Can a minor improvement to the
> new -bis draft fix it?
<snip>

Do you mean this:
www.counterpane.com/pgp-attack.html
or something else?

Marc

- -- 
Mutig warf sich die kleine Überwachungskamera zwischen Täter Opfer!
                                        --Rena Tangens / FoeBuD e.V.

---

From: Rodney Thayer <[email-masked]>
Date: Thu, 15 Aug 2002 17:49:00 -0700

my point was, requiring implementors to do compression sucks,
in my opinion.  this attack is insufficient justification.

the attack is a social engineering attack.  forcing implementors
to add onerous code to defend against it is not a good idea.

---

From: Adam Back <[email-masked]>
Date: Fri, 16 Aug 2002 03:13:42 +0100

I agree.  Increasing use of MDC is a better more direct
solution. (It's also a more robust solution -- how long until someone
manages to propogate the attack through compression -- it's not as if
compression were designed to prevent it.)

Also the attack for those who haven't read the paper is really
low-tech.  They're just observing that if you can ask someone to
decrypt a message you can use that to decrypt related messages.  So
you intentionally garble a message, and hope the user sends you the
garbled plaintext back to you to ask what went wrong.  The rest falls
out of the fact that if you garble a few bits of a ciphertext most of
the plaintext will still be intact.

So it's related to the earlier observation that unless a message is
signed you can undetectably (to PGP) garble it's contents.  This also
was hard to do if the message was compressed.  This was the motivation
for the MDC.

Adam

---

From: Carl Ellison <[email-masked]>
Date: Sat, 17 Aug 2002 05:42:29 -0700

At 03:13 AM 8/16/2002 +0100, Adam Back wrote:

>garbled plaintext back to you to ask what went wrong.  The rest
>falls out of the fact that if you garble a few bits of a ciphertext
>most of the plaintext will still be intact.

Y'know, there's an even simpler attack with the same premise.  You
intercept an encrypted e-mail from Alice to Bob.  You take the mail
body out of the message and send that body to Bob under your e-mail
address (or under some address you control that Bob might mistake for
Alice's, which would be even better).  Bob decrypts the message and
replies to it, including the original message body by default.

The mistake here, on Bob's part, is to reply to a message without
paying attention to the e-mail address being used -- rather than
replying to a message with quoted garbage rather than just saying
"that was garbage -- send again".

 - Carl

+------------------------------------------------------------------+
|Carl M. Ellison         [email-masked]     http://world.std.com/~cme |
|    PGP: 75C5 1814 C3E3 AAA7 3F31  47B9 73F1 7E3C 96E7 2B71       |
+---Officer, arrest that man. He's whistling a copyrighted song.---+