Re: [openpgp] signed/encrypted emails vs unsigned/unencrypted headers

[Daniel Kahn Gillmor <[e-mail]>]

On 07/17/2013 02:27 PM, Ximin Luo wrote:
> As per [2], if I ever sign a message consisting of "yes" or "no" or some other short message with very little context, the attacker (whom I encrypted the signed message to) could use this signed message in some other context, fooling people that I said something I didn't. One might argue "how unlikely", but it's still an unnecessary caveat (i.e. complexity) in using encrypted email, which will confuse people not familiar with the details.
> 
> My original point was that this attack is a specific example of a general design flaw in encrypted email - i.e. unsigned/unencrypted headers.

the attack you're describing above has nothing to do with encryption; it
has to do with signatures.

This is a fundamental vulnerability of any system that involves signed
data that is dependent for interpretation on unsigned context.  This is
also the case for (e.g.) clearsigned plain text files.

It sounds to me like you're proposing a way that some additional context
could be automatically signed by compatible mail user agents.  I think
this is a fine idea, though i think it needs more detail than what has
been sketched out here thus far.  For example, what should a compatible
MUA do if the signed message contains a signed copy of a header which
doesn't match the unsigned header of the message in question?  what if a
signed message contains two sets of signed headers that conflict with
each other?  how should an MUA represent the idea that headers are
signed?  and so forth...

it also sounds like it would be relevant for other e-mail signature
standards too, since S/MIME (for example) might want the same sort of
protection.  This makes it out of scope for the current mailing list,
since it isn't OpenPGP specific.

Werner already suggested that [e-mail] might be a
reasonable place to have this more general discussion.  Maybe followup
should happen over there?

Regards,

	--dkg