Format Oracles on OpenPGP

Abstract

International audienceThe principle of padding oracle attacks has been known in the cryptography research community since 1998. It has been generalized to exploit any property of decrypted ciphertexts, either stemming from the encryption scheme, or the application data format. However, this attack principle is being leveraged time and again against proposed standards and real-world applications. This may be attributed to several factors, \eg, the backward compatibility with standards selecting oracle-prone mechanisms, the difficulty of safely implementing decryption operations, and the misuse of libraries by non cryptography-savvy developers. In this article, we present several format oracles discovered in applications and libraries implementing the OpenPGP message format, among which the popular GnuPG application. We show that, if the oracles they implement are made available to an adversary, e.g. by a front-end application, he can, by querying repeatedly these oracles, decrypt all OpenPGP symmetrically encrypted packets. The corresponding asymptotic query complexities range from 2 to 2^8 oracle requests per plaintext byte to recover

Victory by KO

“…If the adversary were able to carry out a MITM attack, then they could intercept and access the messages, and re-encrypt them to the victim's original encryption subkey, to avoid detection. 23…”

“…Nguyen [26] pointed out that RSA and ElGamal encryption do not achieve CCA security as they both use PKCS#1 v1.5 padding [15], which is vulnerable to Bleichenbacher's attack [4]. Other works showed how messages could be recovered by exploiting some oracles exposed when processing unauthenticated data in non-constant-time [23,25] or by tricking the victim into sharing the seemingly-random decrypted data [13,16]. The EFAIL attack [28] showed how plaintext could be exfiltrated by corrupting encrypted messages and exploiting the mishandling of integrity checks by applications.…”

“…FlowCrypt and ProtonMail developers were informed about the attacks. At the time of writing, the attacks described in this section are no longer possible 23. Since OpenPGP is vulnerable to surreptitious forwarding[5] unless the signature includes a signed Intended Recipient Fingerprint subpacket, the adversary could also relay any original message signature from the sender.…”

Polynomial-Time Plaintext-Recovery Attack on the Matrix-Based Knapsack Cipher

“…These cryptosystems allow the interacting parties to create a shared secret key for a symmetric cipher in such a way that an eavesdropper gets no information useful for cryptanalysis [1,2]. Network protocols that use asymmetric encryption include TLS [3], S/MIME [4], OpenPGP [5], Tor [6] and many others [7].…”