5

Last week I wrote to my bank with a general question. Today I received an email inviting me to join their "Secure Email (PGP) system". It made clear I'd have to join to read their response to my question.

You have received an encrypted email:
From: $CST1, Mailbox
Subject: Your pension fund enmquiry Ref CF-123456
This is the first time you have received encrypted email from Lloyds Banking Group so you will need to set up a password (also referred to as a passphrase) to access this email and any future encrypted emails that you receive from us. Lloyds Banking Group takes online security very seriously.

Reluctantly, I followed the link to sign up, inventing an account password. I duly received a passworded PDF by email, with the response to my question.

Out of curiousity, I explored the rest of the site, which appears to run "Symantec Web Email Protection". On the settings page, I saw it gave a choice how the bank would encrypt messages to me; either as passworded PDF documents or with public key cryptography.

I have an OpenPGP Key or digital ID/certificate (X.509, S/MIME) that I want to use to secure messages I exchange with site [sic].

Following to the next page:

If you already have a key or certificate, you may upload it and we will encrypt your messages to it.

You may upload any of the following: a PGP key (.asc), X.509 Certificate (.pem, .crt, .cer), or PKCS#12 file (.p12, .pfx).

Optional: If your key file has an associated passphrase, please enter it.

That last line surprised me. I've used public key cryptography in OpenSSH and GPG. As I understand, private keys can have passphrases, but not public keys. The purpose of a passphrase is to protect your key on your computer; like the private key, it should be kept secret.

Why would a public key have a passphrase? What's the point of a passphrase if you share it with your correspondents?

Improve this question
6
  • 3
    I know that pkcs#12 files normally have an associated passphrase, because they can contain the private key. But in that case you should never pass it to someone else! I think they wrote that to allow the reception of a (IMHO stupid) pkcs#12 file that would contain only the public key but would have a passphrase. I agree that it would be rather stupid, but I have already seen strange requests reaching a help desk, so I would not be surprised in one user sent me a monster like that, explaining that it is the best they can do :-) – Serge Ballesta Sep 23 '16 at 14:17
  • Change the bank! As @Serge already pointed out: The pkcs12 file contains your private key. If you also send the passphrase, your bank can access the private key. – cornelinux Sep 24 '16 at 10:21
  • I assume you verified its not a phishing attempt? – user3244085 Sep 24 '16 at 12:30
  • 1
    @user3244085 How is one supposed to verify the authenticity of emails like this? Everything about it screamed phishing, down to the bad spelling "Your pension fund enmquiry [sic]". It came from a different address to that I originally emailed (albeit the same domain), and didn't quote my original message. The only factor in favour was the sign-up link went to a subdomain of my bank's legit website. – Colonel Panic Sep 27 '16 at 10:55
  • 1
    @Serge PKCS12 is intended and normally used for privatekey plus cert/chain. However the spec is so flexible it can be used for only cert/chain, and the two cases I know that can do this (Oracle Java 8 fairly easily, OpenSSL with some effort) do use weak PBE for the CertBag, plus PBMAC on the container. That said, I concur an ordinary user giving a '12 to anyone is almost certainly doing it wrong. – dave_thompson_085 Sep 28 '16 at 18:32
4

I think they're just trying to be user-friendly, in the worst possible way. PKCS#12 files (.p12 or .pfx) are used for key pairs - both the public and private parts - and the private part will be encrypted. The bank never needs, nor should ever see, the private key! Consequently, they shouldn't even accept such files - just the .der or .cer or .pem or .crt for the X.509 certificate (which only contains the public key) to use S/MIME, or the .asc or sometimes .pub PGP public key (of course, a .asc file can contain anything, but we'll hope the user wasn't stupid enough to export their private key) - and definitely shouldn't ask for a passphrase.

Anything that the bank needs a passphrase for, that means the user uploaded the wrong file. Public keys do not have, and do not need, passphrases. That's presumably why the field is optional - anybody using the form correctly will not have a passphrase on the file they upload, because they'll be uploading a public key (only) - but it's still absolutely abysmal design on the part of the bank.

With that said, good on them for supporting secure email at all. My bank still think that (trivially wire-tappable) fax machines and (easily-stolen) snail-mail post are the height of secure remote communications.

Improve this answer
1

The system they describe in their Documentation is not the standard way of using PGP. They use some extra PDF encryption on the way, so without knowing exactly every step they use, it is hard to tell which "associated passphrase" they are talking about there.

I think they don't mean a passphrase of your public key-file, but rather of some other key file you have to create in this complex PDF encryption process they use there.

Another interpretation could be, that some very unexperienced users use their GPG program and export their private and public keypair in one file and send this whole file to the bank. Although this is the worst thing that can happen to someones private key, it would still be harmless, if that key is only created and used with that bank. So maybe in this case the bank could only open the keypair knowing the password to extract the public key?
Note: If they would do this without informing the user that they could know their private key now, I would change the bank ;-)

Improve this answer
0

Nowhere in their documentation does it make any reference to private vs public key, so I'm immediately suspicious. In my experience, many people get very confused about the difference (e.g., "So I send you the private key so you can encrypt privately just to me right?"). I'm not aware of any PGP key having a passphrase on the public key.

So I would suspect that some users are sending in their private keys and the author of the document couldn't open them so started asking for the passphrase, not knowing they are different.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.