Re: [openpgp] Encryption and signature context parameter (Was: OpenPGP encryption block modes)

Hi Marcus,

Thanks for your message and research, and apologies for the delay, it
took me a while to look at it.

On the one hand, I personally think that supporting multiple encrypted
parts, or mixing encrypted and unencrypted parts, and replacing an
encrypted MIME part with an unencrypted part in-place, is fraught, and
in ProtonMail we don't support it. Nevertheless, I know it's something
that is done, and some users expect it.

On the other hand, I agree that having some binding between the
encryption and the email context would be valuable. In an ideal world,
we would all be using PGP/MIME with protected headers, but as you point
out, PGP/MIME can also be downgraded to PGP/Inline, so that might not
even be sufficient.

So, I agree it could be valuable to add something like this, though
it's a bit last minute. But we could indeed do so for SEIPDv2 without
breaking stuff. However, to do so we would need to define somewhere
what the AD should be, for example in a spec about PGP/MIME, and
perhaps also for PGP/Inline, etc.

As a slightly orthogonal point, there have also been security issues
with signatures being reused in different contexts. The Intended
Recipient Fingerprint subpacket fixes one of those, but not all.
I think it would be valuable to have a `context` parameter in OpenPGP
that is used for both signatures and encryption, and then the
higher-level spec or application using OpenPGP can define how the
context should be computed. That might also address some of the
concerns in your other message about email signature spoofing,
perhaps.

If there is interest in this, I can make some MRs proposing changes to
that effect.

Best,
Daniel

------- Original Message -------
On Monday, August 8th, 2022 at 21:19, Marcus Brinkmann wrote:

> > Am 02.08.2022 um 18:59 schrieb Bruce Walzer bwalzer@59.ca:
> 
> > AEAD isn't even a very accurate term in an OpenPGP context. There is
> > no AD (associated data) exposed to the user of such a system. It just
> > doesn't work that way.
> 
> 
> It would be very useful to expose AD in OpenPGP to users to prevent exfiltration attacks in the context of email. See our research at [1].
> 
> Thanks,
> Marcus
> 
> [1] Jörg Schwenk, Marcus Brinkmann, Damian Poddebniak, Jens Müller, Juraj Somorovsky, and Sebastian Schinzel. 2020. Mitigation of Attacks on Email End-to-End Encryption. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security (CCS '20). Association for Computing Machinery, New York, NY, USA, 1647–1664. https://doi.org/10.1145/3372297.3417878
> 
> Preprint available here: https://www.nds.ruhr-uni-bochum.de/media/nds/veroeffentlichungen/2020/12/06/schwenk2020.pdf
> 
> —
> Dipl.-Math. Marcus Brinkmann
> 
> Lehrstuhl für Netz- und Datensicherheit
> Ruhr Universität Bochum
> Universitätsstr. 150, Geb. ID 2/461
> D-44780 Bochum
> 
> Telefon: +49 (0) 234 / 32-25030
> http://www.nds.rub.de/chair/people/mbrinkmann
> 
> _______________________________________________
> openpgp mailing list
> openpgp@ietf.org
> https://www.ietf.org/mailman/listinfo/openpgp