Hector Martin

GPZ> So we found these vulns related to CPU specula- Academia> ME ME ME TOO ALSO HERE'S A NAME AND A LOGO THE WORLD IS ENDING!!! Cure53> So Enigmail has some issue- Academia> OMG PGP IS DEAD EVERYONE STOP USING IT NOW ALSO NAME AND A LOGO!!! Starting to notice a pattern here.

Did Cure53 get arbitrary plaintext exfiltration across many clients? Serious question. I missed this result. Link?

"Arbitrary" is, er, rather generous. But sure, Cure53 didn't get the automated exfiltration, but did set the stage with the partial decryption story. My point is rather about the FUD that academic security teams seem to be rather prone to lately.

I would go further: the fact that you can maul encrypted PGP emails in various ways was known well before Cure53. It’s been known since the late 1990s. But nobody has ever taken it seriously enough to comprehensively address it across all clients. Guess why?

IMO, because active content in e-mails is an ancient horse that has been beaten to death and the fact that this is *still* a problem just demonstrates a pervasive failure of email clients to take privacy seriously, PGP completely aside.

This isn’t just about active content. It’s about the fact that active content can be subtly and comprehensively inserted into encrypted emails using very sophisticated cryptographic techniques, AND that content can be made to exfiltrate other encrypted portions of the data.

The root causes here are various, but one of them is active content in general. Another is the lack of MACs in PGP (originally). Another is that apparently it's 2018 and people are still not checking error codes. Another is that PGP mail is a patchjob of pseudo-standards.

All of these flaws (still) exist in 2018 because nobody thought they were comprehensively exploitable together. Now they’re being fixed. This is a good outcome.