Re: [openpgp] Tapping Into Format Oracles in Email End-to-End Encryption

[iang <[e-mail]>]

On 20/01/2023 12:13, Marcus Brinkmann wrote:
> My opinion:
>
> Although limitations in email clients do not lead to practical attacks 
> in other cases, this is something that can change over time. The 
> importance of this work is to raise awareness that S/MIME and OpenPGP 
> are not just static data formats for encryption at rest, but used in 
> dynamic applications where oracle queries are possible. The OpenPGP 
> community should be aware of this risk and ensure that the chance for 
> format oracles in the standard is minimized.


PGP has always been a data format, and perhaps always will be. This is a 
strong assumption.

But that assumption may be well past its use-by date.  Arguably, every 
use of PGP rubs up against protocols (*).  And when that happens, the 
discordance between data formats and the protocols leads to a mess.  Eg, 
opportunity for insecurity, but PGP is not to blame bc it's just a data 
format.

This "throw the problem over the wall" approach isn't good for security. 
You aren't doing security if you just declare your bit good;  security 
is end-to-end, top-to-bottom, from inside to outside, including the people.

Lots of people are still using OpenPGP for their secure applications, as 
one layer in a complex stack.  Which may be fine for those people who 
are used to that, but the success of the market-leading applications 
points to a different way - top-to-bottom custom protocols with crypto 
and formats tightly integrated.  Eg Signal, Skype, perhaps Apple.

Instead of the components model which PGP epitomises.  Just how far can 
we go in delivering protection when OpenPGP isn't part of the protocol 
design?

iang


(*) one might be able to say that backups don't rub up against 
protocols, but it's only partial.