[openpgp] Re: multi-key collisions in OpenPGP

Am 19.11.25 um 13:52 schrieb Daniel Huigens:
> Hi Falko,
>
> On Wednesday, November 19th, 2025 at 13:15, Falko Strenzke wrote:
>>
>> Hi Daniel,
>>
>> Am 19.11.25 um 11:37 schrieb Daniel Huigens:
>>> I do agree that it's novel that such an error may indicate not just 
>>> a truncation but also an attempted MKC attack, indeed, and 
>>> communicating this clearly may require some care. In either case, 
>>> though, the integrity of the displayed message is not verified (as a 
>>> whole), somewhat similarly to if an expected signature had failed to 
>>> verify at the end, so perhaps an error message could focus on that.
>>>
>>> Let me know whether that sounds reasonable or if you disagree.
>>
>> Yes, sounds all reasonable to me.
>>
>> In the last paragraph, do I understand correctly that you mean that 
>> an error message about the failing verification of the final 
>> authentication tag should say something about the possibility MKC 
>> (additionally to the possibility to truncation attacks)?
>>
> I'm not sure how much we should go into the detail about possible 
> attacks and such. Perhaps simply saying something like "The integrity 
> of this message could not be verified" is sufficient to cover all 
> cases, in principle?
>
Seems reasonable. If there was some some resource on the web agreed on 
by the community that describes the risks around early released 
plaintext, an error messages could refer to that URL for the details. 
But currently something like this probably doesn't exist.

Best regards,
Falko

> Best,
> Daniel
>
>
> _______________________________________________
> openpgp mailing list [email protected]
> To unsubscribe send an email [email protected]
-- 

*MTG AG*
Dr. Falko Strenzke

Phone: +49 6151 8000 24
E-Mail: [email protected]
Web: mtg.de <https://www.mtg.de>

------------------------------------------------------------------------

MTG AG - Dolivostr. 11 - 64293 Darmstadt, Germany
Commercial register: HRB 8901
Register Court: Amtsgericht Darmstadt
Management Board: Jürgen Ruf (CEO), Tamer Kemeröz
Chairman of the Supervisory Board: Dr. Thomas Milde

This email may contain confidential and/or privileged information. If 
you are not the correct recipient or have received this email in error,
please inform the sender immediately and delete this email.Unauthorised 
copying or distribution of this email is not permitted.

Data protection information: Privacy policy 
<https://www.mtg.de/en/privacy-policy>

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]