Re: [openpgp] Mitigation of Attacks on Email End-to-End Encryption

Marcus Brinkmann <marcus.brinkmann@rub.de> Tue, 03 November 2020 17:02 UTC

Return-Path: <marcus.brinkmann@rub.de>
X-Original-To: openpgp@ietfa.amsl.com
Delivered-To: openpgp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 20CBE3A0DDA for <openpgp@ietfa.amsl.com>; Tue, 3 Nov 2020 09:02:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.346
X-Spam-Level:
X-Spam-Status: No, score=-2.346 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.247, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=rub.de
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DWDPsbqRlz4a for <openpgp@ietfa.amsl.com>; Tue, 3 Nov 2020 09:02:41 -0800 (PST)
Received: from out2.mail.ruhr-uni-bochum.de (out2.mail.ruhr-uni-bochum.de [IPv6:2a05:3e00:c:1001::8693:2ae5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 551B23A0DD5 for <openpgp@ietf.org>; Tue, 3 Nov 2020 09:02:41 -0800 (PST)
Received: from mx2.mail.ruhr-uni-bochum.de (localhost [127.0.0.1]) by out2.mail.ruhr-uni-bochum.de (Postfix mo-ext) with ESMTP id 4CQbgg1k19z8SXc; Tue, 3 Nov 2020 18:02:39 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=rub.de; s=mail-2017; t=1604422959; bh=3vgq/ijD3+6YTPuyms//un5oWyqg9HJFYoDV9ioBidM=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=CuEdeJlBi6jgNGgmqMI7Yuo2Dx/JovUsO/O7NdwKllW5GzB4y68pxQixF99Q7Fk+T uSXwfW5rL6mAr2JQpmVtdTnHC4scavNzqFeMKN8TOkbGznYvEDvKRKRc7JgmzQw43W Mszj2xq2cs+Qy9s6UWc1dqkyIhLixmhfaN+9HlOg=
Received: from out2.mail.ruhr-uni-bochum.de (localhost [127.0.0.1]) by mx2.mail.ruhr-uni-bochum.de (Postfix idis) with ESMTP id 4CQbgg0434z8SPb; Tue, 3 Nov 2020 18:02:39 +0100 (CET)
X-Envelope-Sender: <marcus.brinkmann@rub.de>
X-RUB-Notes: Internal origin=IPv6:2a05:3e00:c:1001::8693:2aee
Received: from mail2.mail.ruhr-uni-bochum.de (mail2.mail.ruhr-uni-bochum.de [IPv6:2a05:3e00:c:1001::8693:2aee]) by out2.mail.ruhr-uni-bochum.de (Postfix mi-int) with ESMTP id 4CQbgf1PcPz8SW7; Tue, 3 Nov 2020 18:02:38 +0100 (CET)
X-Virus-Status: Clean
X-Virus-Scanned: clamav-milter 0.102.1 at mx2.mail.ruhr-uni-bochum.de
Received: from [192.168.142.186] (p5dca48ad.dip0.t-ipconnect.de [93.202.72.173]) by mail2.mail.ruhr-uni-bochum.de (Postfix) with ESMTPSA id 4CQbgd5f3XzDh15; Tue, 3 Nov 2020 18:02:37 +0100 (CET)
X-Virus-Status: Clean
X-Virus-Scanned: clamav-milter 0.102.4 at mail2.mail.ruhr-uni-bochum.de
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>, openpgp@ietf.org
Cc: =?UTF-8?Q?J=c3=b6rg_Schwenk?= <joerg.schwenk@rub.de>, =?UTF-8?Q?Jens_M=c3=bcller?= <jens.a.mueller@rub.de>, Sebastian Schinzel <schinzel@fh-muenster.de>, Damian Poddebniak <poddebniak@fh-muenster.de>, Juraj Somorovsky <juraj.somorovsky@rub.de>
References: <80af2d9c-f646-4167-209d-5fb35c880682@rub.de> <81da533b-094f-b16c-a71b-927441e8c18b@cs.tcd.ie>
From: Marcus Brinkmann <marcus.brinkmann@rub.de>
Message-ID: <4aab24c2-b6f8-4087-5634-0d93bde1060e@rub.de>
Date: Tue, 3 Nov 2020 18:02:37 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.4.0
MIME-Version: 1.0
In-Reply-To: <81da533b-094f-b16c-a71b-927441e8c18b@cs.tcd.ie>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/openpgp/i4Pv1jpBjp_Wl_PVV5KgsDZH6Zs>
Subject: Re: [openpgp] Mitigation of Attacks on Email End-to-End Encryption
X-BeenThere: openpgp@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Ongoing discussion of OpenPGP issues." <openpgp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/openpgp>, <mailto:openpgp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/openpgp/>
List-Post: <mailto:openpgp@ietf.org>
List-Help: <mailto:openpgp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/openpgp>, <mailto:openpgp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 03 Nov 2020 17:02:44 -0000

Hi,

sorry, I did not test the DOI. The URL is:

https://dl.acm.org/doi/10.1145/3372297.3417878

The PDF is at:

https://dl.acm.org/doi/pdf/10.1145/3372297.3417878

Thanks,
Marcus

On 11/3/20 5:35 PM, Stephen Farrell wrote:
> 
> Hiya,
> 
> Interesting work and I look forward to seeing your
> suggestions as we go.
> 
> One thing: the DOI URL below gets me a "not found"
> error but indicates that may change in future. Is
> that correct? If so, be great if you could send a
> ping when the paper is available (or another URL
> to a preprint or whatever).
> 
> Thanks,
> S.
> 
> 
> On 03/11/2020 16:24, Marcus Brinkmann wrote:
>> Hello,
>>
>> we have just published a paper on our research how to mitigate attacks
>> on email end-to-end encryption. The full paper is available here with
>> open access:
>>
>> Jörg Schwenk, Marcus Brinkmann, Damian Poddebniak, Jens Müller, Juraj
>> Somorovsky, and Sebastian Schinzel. 2020. Mitigation of Attacks on Email
>> End-to-End Encryption. In Proceedings of the 2020 ACM SIGSAC Conference
>> on Computer and Communications Security (CCS '20). Association for
>> Computing Machinery, New York, NY, USA, 1647–1664.
>> DOI:https://doi.org/10.1145/3372297.3417878
>>
>> We have analyzed three attack vectors: EFAIL malleability gadgets (MG),
>> EFAIL direct exfiltration (DE), and REPLY attacks.
>>
>> MG attacks exploit unauthenticated block cipher modes such as CBC and
>> CFB, and are mitigated by using an authenticated encryption mode such as
>> AEAD, or by a strict implementation of OpenPGP's modification detection
>> code.  S/MIME 4.0 and OpenPGP RFC4880bis have added AEAD encryption
>> modes, and assuming a strict implementation, can also protect against MG
>> attacks that way. (Currently, RFC4880bis does allow unsafe
>> implementations of AEAD, and even encourages them due to unrestricted
>> chunk sizes. This has been previously discussed, and I will re-raise
>> this issue when the WG has been reinstantiated).
>>
>> EFAIL DE attacks rely on modifications of the MIME structure to embed
>> authentic ciphertexts in a context that allows exfiltration of the
>> plaintext after decryption, for example through image source URLs in a
>> HTML MIME element before the ciphertext. These attacks have also been
>> published in the EFAIL paper, and so far were only mitigated at the
>> recipient side by ad-hoc measures in email clients. Our experience was
>> that developers were struggling to mitigate these attacks. For example,
>> we found several bypasses after attempts at mitigation.
>>
>> REPLY attacks are known for 20+ years: They rely on modifications of the
>> email header (SMTP) context, that allow the attacker to receive replies
>> to authentic ciphertexts, were the victim quotes the plaintext back to
>> the attacker. To our knowledge, these attacks have not been mitigated so
>> far. We have looked at reply attacks in our paper on covert content
>> attacks [COVERT].
>>
>> We have looked systematically at these issues, and propose to protect
>> the MIME and SMTP context of an email by adding a summary of this
>> decryption contexts (DC) as associated data (AD) in the AEAD encryption.
>> This way, any significant modification to these contexts that indicate
>> an attack would lead to a decryption error, rather than emitting the
>> plaintext to the application, where it would be subject to a large
>> attack surface to launch DE or REPLY attacks.
>>
>> To support this mechanism, OpenPGP RFC4880bis would need to be amended
>> to allow applications to add arbitrary data to the AD, either directly
>> (length+value) or by adding a hash representation (constant length). I
>> plan to introduce a proposal for these changes when the WG is
>> reinstantiated.
>>
>> We have evaluated which SMTP headers are relevant for REPLY actions in
>> email clients, and which MIME contexts can be considered safe. Based on
>> this (and inspired by DKIM), we make a specific proposal for calculating
>> the decryption context which is sender-enforced and extensible.
>>
>> We have implemented this solution with GnuPG and Thunderbird/Enigmail.
>> It was easy to implement, offered excellent compatibility (low false
>> positive rate when detecting attacks) and mitigated all REPLY and DE
>> attacks conclusively without introducing new cryptographic primitives.
>>
>> I hope these findings are interesting to the OpenPGP community. For
>> example, some of the problems described in
>>
>> https://www.ietf.org/archive/id/draft-dkg-lamps-e2e-mail-guidance-00.txt
>>
>> can be mitigated using our techniques. Also, the REPLY action behavior
>> of email clients in our evaluation should be useful for the memory hole
>> project, for example.
>>
>> Thanks,
>> Marcus
>>
>>
>> Bibliography:
>>
>> [COVERT] Jens Müller, Marcus Brinkmann, Damian Poddebniak, Sebastian
>> Schinzel, and Jörg Schwenk. 2019. Re: What’s Up Johnny? – Covert Content
>> Attacks on Email End-to-End Encryption.
>> https://arxiv.org/ftp/arxiv/papers/1904/1904.07550.pdf.
>>
>> [EFAIL] Damian Poddebniak, Christian Dresen, Jens Müller, Fabian Ising,
>> Sebastian Schinzel, Simon Friedberger, Juraj Somorovsky, and Jörg
>> Schwenk. 2018. Efail: Breaking S/MIME and OpenPGP Email Encryption using
>> Exfiltration Channels. In 27th USENIX Security Symposium, USENIX
>> Security 2018, Baltimore, MD, USA, August 15-17, 2018., William Enck and
>> Adrienne Porter Felt (Eds.). USENIX Association, 549–566.
>> https://www.usenix.org/conference/usenixsecurity18/presentation/poddebniak
>>
>>

-- 
Dipl.-Math. Marcus Brinkmann

Lehrstuhl für Netz- und Datensicherheit
Ruhr Universität Bochum
Universitätsstr. 150, Geb. ID 2/461
D-44780 Bochum

Telefon: +49 (0) 234 / 32-25030
http://www.nds.rub.de/chair/people/mbrinkmann