[openpgp] Re: multi-key collisions in OpenPGP [was: Re : Re: on the risks of AEAD as signature]

Daniel Kahn Gillmor <[email protected]> Fri, 14 Nov 2025 09:09:29 -0500

Newsgroups	gmane.ietf.openpgp
Message-ID	<[email protected]>

On Fri 2025-11-14 09:48:46 +0100, Falko Strenzke wrote:
> What the paragraph is meant to say is that the plaintext of decrypted 
> AEAD chunks might be output by an application before the verification of 
> the final authentication tag. In that case, if this plaintext is 
> processed, and the error of the failing verification of the final 
> authentication tag was ignored, MKC is possible.

Yes, this does make sense, thanks.

This seems like a challenging thing to test, given the wide variety of
OpenPGP APIs out there, let alone the range of consumers of those APIs
and their various tolerances for ignoring errors.

I suppose a baseline test would be to have an artifact with a broken
final tag, and see how various implementations behave when processing
it via their sop interface:

- do they emit any cleartext?

- do they validate any signatures found in the data leading up to the
  failed tag?

I've opened
https://gitlab.com/sequoia-pgp/openpgp-interoperability-test-suite/-/issues/171
to track that suggestion.

  --dkg

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]

signature.asc (application/pgp-signature, 324 B)