[openpgp] Re: multi-key collisions in OpenPGP

Hi Daniel,

Am 19.11.25 um 11:37 schrieb Daniel Huigens:
> Hi Falko,
>
> On Monday, November 17th, 2025 at 10:54, Falko Strenzke wrote:
>> Releasing plaintext before the final chunk is only a problem if the 
>> message isn't cancelled after seeing the final authentication tag or 
>> the lack of it. If incompletely verified plaintext in this sense is 
>> rendered to the user or otherwise processed, this is a problem first 
>> of all due allowing truncation attacks. The possibility of MKC would 
>> only be further problem. But for MKC to be a real problem, we need a 
>> special setting (see my example below).
>
> Thanks for the clarification and concrete example.
>
> I agree that, if the final authentication tag fails to validate, the 
> implementation should return an error message as RFC9580 requires. 
> However, when streaming, data may already be output to stdout or 
> processed in some other way (e.g. if you have a streaming MIME parser) 
> before that. As long as a clear error message is displayed to the 
> user, I think that should be OK (or at least it's not any worse than 
> displaying or processing an unencrypted and unsigned message, for 
> example).
>
> I do agree that it's novel that such an error may indicate not just a 
> truncation but also an attempted MKC attack, indeed, and communicating 
> this clearly may require some care. In either case, though, the 
> integrity of the displayed message is not verified (as a whole), 
> somewhat similarly to if an expected signature had failed to verify at 
> the end, so perhaps an error message could focus on that.
>
> Let me know whether that sounds reasonable or if you disagree.

Yes, sounds all reasonable to me.

In the last paragraph, do I understand correctly that you mean that an 
error message about the failing verification of the final authentication 
tag should say something about the possibility MKC (additionally to the 
possibility to truncation attacks)?

>
> Best,
> Daniel
>
>
> _______________________________________________
> openpgp mailing list [email protected]
> To unsubscribe send an email [email protected]
-- 

*MTG AG*
Dr. Falko Strenzke

Phone: +49 6151 8000 24
E-Mail: [email protected]
Web: mtg.de <https://www.mtg.de>

------------------------------------------------------------------------

MTG AG - Dolivostr. 11 - 64293 Darmstadt, Germany
Commercial register: HRB 8901
Register Court: Amtsgericht Darmstadt
Management Board: Jürgen Ruf (CEO), Tamer Kemeröz
Chairman of the Supervisory Board: Dr. Thomas Milde

This email may contain confidential and/or privileged information. If 
you are not the correct recipient or have received this email in error,
please inform the sender immediately and delete this email.Unauthorised 
copying or distribution of this email is not permitted.

Data protection information: Privacy policy 
<https://www.mtg.de/en/privacy-policy>

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]