##Dangers of printing untrusted text
The encrypted message could contain any sort of untrusted/malformed data that could try to exploit my bash environment, my terminal emulator, etc.
When outputting arbitrary text to a terminal, as GnuPG does by default, you are risking the exploitation of your terminal emulator. New vulnerabilities regarding handling of untrusted text being printed are found all the time, and while the most severe vulnerabilities have been weeded out, they are still an issue. One solution would be to pipe the untrusted output through a command that strips non-printing characters. You can use
cat -v for this purpose. From section 3.1 of the coreutils GNU Info page:
Display control characters except for LFD and TAB using ^ notation
and precede characters that have the high bit set with M-.
Printing untrusted text while stripping non-printing characters should prevent exploitation of your terminal emulator through mishandled control codes or any other typical avenue of attack.
$ gpg -d untrusted.gpg | cat -v
##Dangerous of decrypting untrusted messages
Any potential vulnerabilities in GnuPG or whatever PGP client I am using could also be exploited by the untrusted data.
This is also a risk. GnuPG is incredibly complex, and any parsing of complex data can lead to exploitation. The only solution would be to run GnuPG airgapped, or in a tight sandbox or properly isolated virtual machine. GnuPG v2 has improved its architecture, allowing the decryption to occur in a process which has no access to your private key, but this is far from a complete sandbox. In general, you should always assume that a sufficiently competent attacker will be able to exploit GnuPG through way of providing you with a maliciously malformed encrypted message.
A quick search turned up several bad vulnerabilities in GnuPG in the past 10 years:
- CVE-2008-1530 - Memory corruption via duplicate keys from keyservers allowing code execution.
- CVE-2010-2547 - Use-after-free vulnerability in certificate parsing allowing code execution.
- CVE-2013-4242 - Side-channel attack revealing private key information to local processes.
- CVE-2013-4576 - Side-channel attack allowing acoustic cryptanalysis during RSA decryption.
- CVE-2016-6313 - Broken RNG leaking 160 bits of random material, weakening certain key types.
##But what is the actual risk?
Am I going too far with this risk or should I use an air-gapped single-use offline machine to decrypt each individual message, and securely erase it afterwards? What other security controls or practises can I put in place to help?
An airgapped machine would do nicely, but may not always be an option. There is no need to securely erase the messages afterwards, as an unlinked (deleted) message poses no risk. The only reason to try to securely delete something is if you do not want it to be available through forensic analysis.
Overall, the actual risk should be fairly low. Exploiting a popular program requires a certain level of expertise which is unlikely to be used to compromise you through your website unless you are high profile, or very unlucky. There are easier ways to be compromised through an exploit that via GnuPG messages (for example, hyperlinks to compromise your browser, images to compromise image parsers, etc). Even so, there are a few things you can do to reduce this risk with regards to GnuPG:
- Decrypt messages using an unprivileged, or better yet dedicated, user.
- Strip control codes from decrypted output. Never view raw output with
- Keep GnuPG up to date at all times so known vulnerabilities will be patched on your system.
- Use the virtual terminal and not a terminal emulator. Never use
xterm or related forks.
- Use AppArmor or similar on GnuPG. Do not run it under a user with X11 access.