5

I've just read the RFC 4880 specs and there is nothing about OAEP; only PKCS#1 v1.5. If it is true that the OpenPGP-standard only supports the PKCS#1 v1.5 padding-scheme, is this a security issue?

Usually it's said that you should not use PKCS#1 v1.5 anymore or just for legacy reasons because it allows padding-oracle-attacks. However, OpenPGP/GnuPG is considered secure. So, are the padding-oracle-attacks feasible?

(I think they shouldn't be possible, because the recipient doesn't send any information back to the sender; but I'm not an expert, so I'm asking here)

Some second thoughts: Padding-oracle-attacks should not be possible if you verify the signature of the sender and only decrypt the message if the sender is valid or am I wrong here?

Improve this question

2 Answers 2

Reset to default
2

As you may have noticed, section 11.3 of RFC4880 enumerates the legal packet compositions. In practice, you will observe that the signed payload is embedded in the encrypted message, so you can only check the signature after decrypting the message.

Regarding other matters, your statement "OpenPGP is considered secure" is wrong under some circumstances. OpenPGP is, regarding many aspects, not secure against oracle attacks (mainly because of the lack of authenticated encryption scheme) and should probably not be used in automated decryption procedures unless you are a crypto expert knowing how to appropriately mitigate all of the possible information leaks. This statement is supported by many OpenPGP developers and this risk is clearly documented by some of them (e.g. End-to-end team).

For what it worths, next CT-RSA conference will host a talk about some new OpenPGP CCA vulnerabilities that were found in many OpenPGP implementations : http://www.rsaconference.com/events/us15/agenda/sessions/1761/chosen-ciphertext-attacks-in-theory-and-practice

edit:typo

Improve this answer
0

In all fairness, OpenPGP is still "secure" in the offline file encryption/decryption scenario. I don't think you can do oracle or timing attacks on an encrypted file 😁

Improve this answer
1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Feb 3, 2023 at 9:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .