Bug May Expose Encrypted E-mail

[HardOCP News]

C|Net is reporting on a bug in open-source GnuPG cryptography technology that could potentially allow people to tamper with digitally signed messages.

The problem lies in how certain e-mail applications display messages signed using the GNU Privacy Guard, also known as GnuPG and GPG, the GnuPG group said in a security alert Tuesday. It may not be possible to identify which part of a message is actually signed if GPG is not used correctly, it said.

 

[Farva]

Not really a surprise as OpenSSH had a security hole in it a few months back, but was quickly patched.

"It is possible to insert additional text before or after a signed, or signed and encrypted, OpenPGP message and make the user believe that this additional text is also covered by the signature," according to the alert.

I do not know encryption incredibly well, but if you replied to a message, wouldn't you have to re-encryption it with your public key and sign it? After reading further, it is rather disturbing to see that you are able to sign for part of a message and not another part. I would imagine this would be a problem then for spam and the like to exploit something like this.

 

[Nephelim]

The problem is not with encrypted messages, but with digitally signed messages.

So the message is in cleartext, but at the bottom is a little bit that is supposed to be verifiable and say "Yeah, I really said this". So someone can't take that message edit the main text, and then present it as what you really said.

This bug is, as I understand it, quite a corner case, but would allow you to do exactly that.

According to a friend of mine who works at PGP, this problem exists in their CLI as as well.