[openpgp] Tapping Into Format Oracles in Email End-to-End Encryption

[Marcus Brinkmann <[e-mail]>]

Hi,

There has been a prepublication for a paper appearing on USENIX 2023 from our colleagues at Münster University of Applied Sciences (the research group by Sebastian Schinzel that also published EFAIL). It is about format oracles in email end-to-end encryption.

https://www.usenix.org/system/files/sec23summer_217-ising-prepub.pdf

The paper is titled "Content-Type: multipart/oracleTapping into Format Oracles in Email End-to-End Encryption“ and written by Fabian Ising, Damian Poddebniak, Tobias Kappert, Christoph Saatjohann, and Sebastian Schinzel, all affiliated with Münster University of Applied Sciences.

The basic idea is that an attacker who can send encrypted emails to a victim and observe the (TLS protected) IMAP connection passively is able to see network patterns based on the decryption state of parts of the MIME tree. By cleverly exploiting the „interplay of MIME, IMAP, and SMTP“ they are able to construct side-channels leaking information about the decryption process. In one client this "leads to a practical format oracle attack against S/MIME."

My opinion:

Although limitations in email clients do not lead to practical attacks in other cases, this is something that can change over time. The importance of this work is to raise awareness that S/MIME and OpenPGP are not just static data formats for encryption at rest, but used in dynamic applications where oracle queries are possible. The OpenPGP community should be aware of this risk and ensure that the chance for format oracles in the standard is minimized.

I have pointed out previously here on the mailing list that this is an emergent risk, and that the standard should be rigorous in defending against any format oracles. An important example is the correct implementation of AEAD modes, in that modified cipher text is never processed (for example, it should not be decompressed), or output. Another example are the quick check bytes, for which this risk was known. But there are other possible format oracles hidden in OpenPGP data structures and implementations. Such oracles can be hard to find, but there has also been work on automating this (see https://www.usenix.org/system/files/sec20-beck_0.pdf "Automating the Development of Chosen Ciphertext Attacks“ by Gabrielle Beck, Maximilian Zinc’s and Matthew Green at John Hopkins University). Attacks only get better!

Thanks to the authors for publishing this work, which pushes the boundary of what we know attackers can do in this area!

—
Dipl.-Math. Marcus Brinkmann

Lehrstuhl für Netz- und Datensicherheit
Ruhr Universität Bochum
Universitätsstr. 150, Geb. ID 2/461
D-44780 Bochum

Telefon: +49 (0) 234 / 32-25030
http://www.nds.rub.de/chair/people/mbrinkmann