1638645 - OpenPGP: Missing MDC protection not discovered

Status: RESOLVED FIXED

(MailNews Core :: Security: OpenPGP, defect, P1)

Description

[Patrick Brunschwig]

If an encrypted message does not contain any MDC protection, then the message is decrypted and the result is displayed as "successfully decrypted".

However, a one of the Efail attacks is based upon modification of messages without MDC protection. The general consensus is that encrypted message MUST have an MDC protection, otherwise they should be treated as invalid.

Comment 1

[Kai Engert (:KaiE:)]

Patrick, thanks for testing this scenario. How could we get to a test case that can be shared?

How about creating an encrypted message to one of the test keys from https://gitlab.com/openpgp-wg/openpgp-samples ?

Comment 2

[Kai Engert (:KaiE:)]

I found that RNP cannot import the example keys as they are, but it simply doesn't seem to like multiple comment lines. After removing the second comment line, I was able to import the secret key.

Comment 3

[Kai Engert (:KaiE:)]

Attachment: alice-bob-test-kuix-public-armor.asc

Here are edited versions of the test keys from the above repository.

I have edited the user IDs, and added email addresses that I control. This makes it easier to use the keys. However, they still use the same key material, so we can easily share the produced test messages, and everyone can decrypt them.

If you are able to create test messages that demonstrate this bug, could you please send them to one of these keys and email address? E.g. alice-test at kuix dot de, or bob-test at kuix dot de. Thanks.

Comment 4

[Patrick Brunschwig]

Attachment: example.eml

Attached is an example message.

To create such a message yourself using gpg use the following command:

gpg -a --rfc2440 --disable-mdc -r recipient -e

Comment 5

[Kai Engert (:KaiE:)]

Thanks Patrick, that's very helpful.

The API rnp_op_verify_t returns a "good" result after decryption.
I have raised the issue with the RNP developers at https://github.com/rnpgp/rnp/issues/1142

Comment 6

[Kai Engert (:KaiE:)]

Attachment: Bug 1638645 - OpenPGP: Missing MDC protection not discovered. r=PatrickBrunschwig

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/cdef6999ca32
OpenPGP: Missing MDC protection not discovered. r=PatrickBrunschwig DONTBUILD

Comment 8

[Kai Engert (:KaiE:)]

Comment on attachment 9159906 [details]
Bug 1638645 - OpenPGP: Missing MDC protection not discovered. r=PatrickBrunschwig

Important security correctness enhancement for OpenPGP

Comment 9

[Wayne Mery (:wsmwk)]

Comment on attachment 9159906 [details]
Bug 1638645 - OpenPGP: Missing MDC protection not discovered. r=PatrickBrunschwig

Approved for beta

Comment 10

[Kai Engert (:KaiE:)]

https://hg.mozilla.org/releases/comm-beta/rev/967707e1200c71b210cc9018dd10e8f773c33adf