[openpgp] Re: multi-key collisions in OpenPGP

Hi Falko,

On Wednesday, November 19th, 2025 at 13:15, Falko Strenzke wrote:

> Hi Daniel,
>
> Am 19.11.25 um 11:37 schrieb Daniel Huigens:
>
>> I do agree that it's novel that such an error may indicate not just a truncation but also an attempted MKC attack, indeed, and communicating this clearly may require some care. In either case, though, the integrity of the displayed message is not verified (as a whole), somewhat similarly to if an expected signature had failed to verify at the end, so perhaps an error message could focus on that.
>>
>> Let me know whether that sounds reasonable or if you disagree.
>
> Yes, sounds all reasonable to me.
>
> In the last paragraph, do I understand correctly that you mean that an error message about the failing verification of the final authentication tag should say something about the possibility MKC (additionally to the possibility to truncation attacks)?

I'm not sure how much we should go into the detail about possible attacks and such. Perhaps simply saying something like "The integrity of this message could not be verified" is sufficient to cover all cases, in principle?

Best,
Daniel

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]