4

This is probably a stupid question/vaguely defined, but I need to ask it anyway.

I want to put a public key for mail exchange on my website, such that even very powerful adversary with power to intercept and fiddle with traffic on both sides and DNS couldn't read e-mails mailed to me.

What I mean is that:

  • the adversary shouldn't be able to do a MITM attack - that means, showing the sender (not me) a false key, intercepting the mail, reading it, re-crypting it, and sending it to me, encrypted with my original key
  • the adversary shouldn't be able to do "reverse" MITM attack - that the sender signs the mail with his key, puts the signature there, but the adversary, when re-cyphering it, adds there a signature with his false key, and showing me the wrong one
  • DNS is just for DKIM

Also,

  • putting https on a webhosting is not secure too, because evil webhoster can fiddle with your files and serve the false keys to different IPs

So, the only solution that I see is to put the public key on your own server, that you control, with https.

So really, to just publish a public GPG key so you can be really sure any powerful adversary is not reading mails intended to you, you need to actually install your own hardware and software with HTTPS? That sounds a little exhausting, actually.

Improve this question
1
  • 3
    This is what certificates and web of trust is for. Either that or you can verify the keys via a side channel (other person rings you up and reads the key fingerprint out over the phone and you confirm it).
    – ewanm89
    Dec 3, 2012 at 10:10

4 Answers 4

Reset to default
5

You are right that an adversary that could intercept all your traffic could put a system in place that would act as a MiTM between all your email recipients and yourself, creating a separate public/private keypair for each recipient and keeping you in the dark on it. There isn't any way you can defend against that totally.

Keep in mind that this would be very difficult to do, and if your attacker has the capacity to intercept and tamper with all your email in this way than you are in real trouble as they'll have plenty of other ways to discover what you are doing.

Public key encryption doesn't truly work unless both sides can trust that the public keys exchanged are authentic to the user, so simply putting your public key on your website isn't enough to ensure that trust, you need to use the public key infrastructure for that.

Improve this answer
1
  • Specifically if someone can intercept and control all your traffic, then objectively speaking to the outside world "they" are indistinguishable from "you" -- in fact "they" are the entity with which outsiders are communicating, and it's entirely at "their" discretion whether "you" have any influence on it at all. That's why other, more trustworthy, channels than the internet are used as the basis of trust for PGP.
    – Steve Jessop
    Mar 30, 2014 at 23:31
2

You need to find a third party that both you and the sender trust, and have them host your public key. Then you don't have to run your own hardware, as the trusted third-party's hardware is deemed to be secure.

Improve this answer
1

I think by definition, any situation where the attacker can see your public key means he can MITM it in the way you describe. Even if the webserver is one you control, if it is public access, the attacker can obtain the public key, and then trick a sender using some other method (e.g. if the attacker controls the senders' DNS servers).

You can trade off convenience by verifying each sender before giving them the "public" key.

In general though, I don't think you can close that attack vector.

Improve this answer
3
  • How so, they can only compromise the entire thing if they are able to present a different public key from the one you posted. As long as the sender uses the correct public key, then the attacker would not have access to the protected contents. The trick is how to give the public key trust. For this you need Public Key Infrastructure either through manual trusted confirmation on a different channel, web-of-trust or a CA signing.
    – AJ Henderson
    Dec 3, 2012 at 14:53
  • 1
    You are assuming the attacker does not control the senders DNS, network, or computer. I'm not making any such assumptions. In particular, it seems that an attacker that will devote significant effort to perform a MITM attack like this is also likely to devote energies to compromising other aspects of the senders IT infrastructure.
    – scuzzy-delta
    Dec 4, 2012 at 21:09
  • 1
    If the attacker controls the sender's PC, then there isn't much of anything that can save you as they can fully impersonate the user. Even with an untrusted computer, you could still tie the use of the private key that is trusted to one or more factors of authentication, but at some point you have to trust that some piece of software somewhere is actually behaving. If an attacker has gone through the effort to compromise your server, your connection, your computer and a CA, they might as well just tell you to say you sent it at gunpoint.
    – AJ Henderson
    Dec 4, 2012 at 21:44
1

In this situation you need either a trusted channel or agreed upon root of trust to validate your public key is you. A trusted channel typically looks like a phone call to validate the public key's fingerprint matches. A root of trust typically looks like either a Certificate Authority validating your identity and then signing the certificate or using a web of trust to attest that your public key is trusted. To fake this, an attacker would have to either get the CA or the web of trust to sign off that their certificate belonged to you.

That said, an attacker could still alter your website to remove indications that the user should expect your public key to be signed and most users wouldn't be any the wiser since key distribution is so frequently done insecurely.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .