List Info

Thread: Multiple Messages Problem in GnuPG and GPGME
Multiple Messages Problem in GnuPG and GPGME
user name
 2007-03-06 02:02:45 
             Multiple Messages Problem in GnuPG and GPGME
           
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=3D=3D=3D=3D=3D
                              2007-03-05


Summary
=3D=3D=3D=3D=3D=3D=3D

Gerardo Richarte from Core Security Technologies identified
a problem
when using GnuPG in streaming mode.

The problem is actually a variant of a well known problem in
the way
signed material is presented in a MUA.  It is possible to
insert
additional text before or after a signed (or signed and
encrypted)
OpenPGP message and make the user believe that this
additional text is
also covered by the signature.  The Core Security advisory
describes
several variants of the attack; they all boil down to the
fact that it
might not be possible to identify which part of a message is
actually
signed if gpg is not used correctly.

[ Please do not send private mail in response to this
message.  The
  mailing list gnupg-devel is the best place to discuss this
problem
  (please subscribe first so you don't need moderator
approval [1]). ]


Impact
=3D=3D=3D=3D=3D=3D

All applications using GnuPG without properly using the
status
interface to verify signed or signed and encrypted
messages.

All GPGME versions up to and including 1.1.3.

Starting with version 1.4.7 and 2.0.3, GnuPG implements an
additional
and sufficient protection against this common usage
problem.

Detached signatures are in no way affected by this problem.


Description
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

When using gpg (or gpg2) in a pipeline or with redirected
input and
output additional data may be inserted into a message.  This
allows to
forge a signed message by prefixing it with arbitrary
material.  A way
to create such a message is:

  echo "This is my sneaky plaintext message" >
foobar.txt
  gpg -z0 --output prefix.gpg --store foobar.txt
  cat prefix.gpg original-signed-message.gpg >
forged.gpg

Using gpg naively this results in:

  $ gpg <forged.gpg
  This is my sneaky plaintext message
  Either I'm dead or my watch has stopped.
                  -- Groucho Marx's last words
  gpg: Signature made Mon Feb 26 09:57:04 2007 CET using DSA
key ID 68697734
  gpg: Good signature from "Alfa Test (demo key)
<alfaexample.net>"
  [...]

and thus gives the impression that the sneaky message is
part of the
signed Groucho quote.  The correct way to use gpg with
redirection is
by taking care of the status interface:

  $ gpg --status-fd 1 <forged.gpg
  [GNUPG:] PLAINTEXT 62 1172479053 foobar.txt
  [GNUPG:] PLAINTEXT_LENGTH 36
  This is my sneaky plaintext message
  [GNUPG:] PLAINTEXT 62 1172480224 original-signed-message
  [GNUPG:] PLAINTEXT_LENGTH 86
  Either I'm dead or my watch has stopped.
                  -- Groucho Marx's last words
  gpg: Signature made Mon Feb 26 09:57:04 2007 CET using DSA
key ID 68697734
  [GNUPG:] SIG_ID UncMPBJYgbG/uszJVNKoCAz+hvY 2007-02-26
1172480224
  [GNUPG:] GOODSIG 2D727CC768697734 Alfa Test (demo key)
<alfaexample.net>
  gpg: Good signature from "Alfa Test (demo key)
<alfaexample.net>"
  [...]

Here the PLAINTEXT status lines clearly identify the start
of a new
message.

Note, that using gpg on the command line is in almost all
cases not
done with redirection but by letting gpg save the the signed
message.
In this case gpg will save the message to different files or
in case
the file names are identical, prompt the over to overwrite
the first
one again.

Because the problem of identifying the actual signed content
when
mixing the signed data and the signature is very common, the
long
standing suggestion for all digital signatures is to use a
detached
signature.  A detached signature allows to clearly identify
what is
signed and what is the signature.  This is also the reason
why
PGP/MIME signed messages are in general to be preferred over
the old
style clear signed messages.


Solution
=3D=3D=3D=3D=3D=3D=3D=3D

Given that there are many applications in use which are
subject to the
described problem, we have decided to change GnuPG so that
such forged
OpenPGP messages are detected and the signature verification
will
fail.  GnuPG 1.4.7 has been released today and is available
from the
usual places [2].  If you don't want to update, a minimal
patch
against GnuPG 1.4.6 is available at

 ftp://ftp.gnupg.org/gcrypt/gnupg/patches/gnupg-1.4.6-multip
le-message.patch

Many applications are using the library GPGME which
implements an easy
way to process OpenPGP messages using gpg.  We have updated
GPGME to
make it immune against this problem even if an old version
of gpg is
being used.  GPGME 1.1.4 is available from the usual places
[2].  A
patch (against version 1.1.3 or 1.1.2) is available at

 ftp://ftp.gnupg.org/gcrypt/gpgme/patches/gpgme-1.1.3-multip
le-message.patch

Please note that - after applying one of these patches -
some
vulnerable applications (mainly MUAs) may fail to handle
certain
messages which are composed of several OpenPGP messages.  To
continue
the support of such messages fixing the application is
required as
there is no way for GnuPG to do it.


Support=20
=3D=3D=3D=3D=3D=3D=3D

g10 Code GmbH [3], a Duesseldorf based company owned and
headed by
GnuPG's principal author, is currently funding GnuPG
development.
Support contracts or other financial backing will greatly
help us to
improve the quality of GnuPG.


Thanks
=3D=3D=3D=3D=3D=3D

Gerardo Richarte found this problem.  David Shaw greatly
helped to
analyse and describe the core of the problem.




[1] See h
ttp://lists.gnupg.org/mailman/listinfo/gnupg-devel
[2] See http://www.gnupg.or
g/download/=20
[3] See http://www.gnupg.or
g/service.html

_______________________________________________
Gnupg-announce mailing list
Gnupg-announcegnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-announce


_______________________________________________
Gnupg-devel mailing list
Gnupg-develgnupg.org
h
ttp://lists.gnupg.org/mailman/listinfo/gnupg-devel
Re: Multiple Messages Problem in GnuPG and GPGME
country flaguser name
United States		 2007-03-06 12:11:49 
Werner Koch wrote:
> The correct way to use gpg with redirection is
> by taking care of the status interface:
> 
>   $ gpg --status-fd 1 <forged.gpg
>   [GNUPG:] PLAINTEXT 62 1172479053 foobar.txt
>   [GNUPG:] PLAINTEXT_LENGTH 36
>   This is my sneaky plaintext message
>   [GNUPG:] PLAINTEXT 62 1172480224
original-signed-message
>   [GNUPG:] PLAINTEXT_LENGTH 86
>   Either I'm dead or my watch has stopped.
>                   -- Groucho Marx's last words
>   gpg: Signature made Mon Feb 26 09:57:04 2007 CET
using DSA key ID 68697734
>   [GNUPG:] SIG_ID UncMPBJYgbG/uszJVNKoCAz+hvY
2007-02-26 1172480224
>   [GNUPG:] GOODSIG 2D727CC768697734 Alfa Test (demo
key) <alfaexample.net>
>   gpg: Good signature from "Alfa Test (demo key)
<alfaexample.net>"
>   [...]
> 
> Here the PLAINTEXT status lines clearly identify the
start of a new
> message.

"clearly"?  Only to a gnupg developer would this
be "clearly".  Granted,
for the most part, the only people using pgp probably can
interpret
this, but if you ever want non-techies to have any hope of
using it,
this needs major improvement.  And I suspect even most
technical people
would prefer something more readable...  How about:

$ gpg < forged.gpg
[GNUPG SEGMENT 1:] foobar.txt
---
This is my sneaky plaintext message
---
[GNUPG STATUS 1:] UNTRUSTED (unsigned, possibly forged)
===
[GNUPG SEGMENT 2:] original-signed-message
---
Either I'm dead or my watch has stopped.
                -- Groucho Marx's last words
---
[GNUPG SIG INFO 2:] Signature made Mon Feb 26 09:57:04 2007
CET using
DSA key ID 68697734
[GNUPG STATUS 2:] Good signature from "Alfa Test (demo
key)
<alfaexample.net>"

Still parseable (which I assume is the reason for the
crypticness), but
readable as well.

And for the developers who want more machine readable info:

$ gpg -v < forged.gpg
[GNUPG SEGMENT 1:] foobar.txt
[GNUPG DATA 1:] PLAINTEXT 62 1172479053 36 foobar.txt
---
This is my sneaky plaintext message
---
[GNUPG STATUS 1:] UNTRUSTED (unsigned, possibly forged)
===
[GNUPG SEGMENT 2:] original-signed-message
---
Either I'm dead or my watch has stopped.
                -- Groucho Marx's last words
---
[GNUPG SIG INFO 2:] Signature made Mon Feb 26 09:57:04 2007
CET using
DSA key ID 68697734
[GNUPG SIG_ID 2:] UncMPBJYgbG/uszJVNKoCAz+hvY 2007-02-26
1172480224
[GNUPG DATA 2:] GOODSIG 2D727CC768697734 Alfa Test (demo
key)
<alfaexample.net>
[GNUPG STATUS 2:] Good signature from "Alfa Test (demo
key)
<alfaexample.net>"

_______________________________________________
Gnupg-devel mailing list
Gnupg-develgnupg.org
h
ttp://lists.gnupg.org/mailman/listinfo/gnupg-devel
Re: Multiple Messages Problem in GnuPG and GPGME
country flaguser name
Switzerland		 2007-03-07 01:51:47 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Alan Batie wrote:
> Werner Koch wrote:
>> The correct way to use gpg with redirection is
>> by taking care of the status interface:
>>
>>   $ gpg --status-fd 1 <forged.gpg
>>   [GNUPG:] PLAINTEXT 62 1172479053 foobar.txt
>>   [GNUPG:] PLAINTEXT_LENGTH 36
>>   This is my sneaky plaintext message
>>   [GNUPG:] PLAINTEXT 62 1172480224
original-signed-message
>>   [GNUPG:] PLAINTEXT_LENGTH 86
>>   Either I'm dead or my watch has stopped.
>>                   -- Groucho Marx's last words
>>   gpg: Signature made Mon Feb 26 09:57:04 2007 CET
using DSA key ID 68697734
>>   [GNUPG:] SIG_ID UncMPBJYgbG/uszJVNKoCAz+hvY
2007-02-26 1172480224
>>   [GNUPG:] GOODSIG 2D727CC768697734 Alfa Test (demo
key) <alfaexample.net>
>>   gpg: Good signature from "Alfa Test (demo
key) <alfaexample.net>"
>>   [...]
>>
>> Here the PLAINTEXT status lines clearly identify
the start of a new
>> message.
> 
> "clearly"?  Only to a gnupg developer would
this be "clearly".  Granted,
> for the most part, the only people using pgp probably
can interpret
> this, but if you ever want non-techies to have any hope
of using it,
> this needs major improvement.  And I suspect even most
technical people
> would prefer something more readable...  How about:
> 
> $ gpg < forged.gpg
> [GNUPG SEGMENT 1:] foobar.txt
> ---
> This is my sneaky plaintext message
> ---
> [GNUPG STATUS 1:] UNTRUSTED (unsigned, possibly
forged)
> ===
> [GNUPG SEGMENT 2:] original-signed-message
> ---
> Either I'm dead or my watch has stopped.
>                 -- Groucho Marx's last words
> ---
[...]

The --status-fd interface is defined and in use for quite a
while, you
cannot just change the core of it without breaking dozens
of
applications. I agree that a some improvements here and
there would be
possible, but it definitely serves the purpose.

The problem is more that the usage of multiple PLAINTEXT
parts --
especially the fact that there can be multiple parts --
doesn't seem to
be documented well enough. I.e. I think that some explicit
mentioning in
the DETAILS document would help much more than changing the
interface in
any way (which would still mean that it would need to be
documented!).

- -Patrick
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org


iQEVAwUBRe5vEHcOpHodsOiwAQIiHgf+NgilEP+GUP4k1WBq3nFVMIZW1DB4
bczZ
/ylfRJCXz9zuEKOLCkLK3kNN1z5+J5/IHcPX+/BQ2dJzpvEpSTjeTRvs7/cz
EGlH
Bhaq+fNQMGJYwgcq9iNpKN81budQBBeUkTdJ7jiA51s9WvAxlbhoSQEZdg9C
r/Fc
T9glBtHkcXKQji3NzuA8K4odoXHxGZKzRwhYCUMR0dPnrIL4Pkv4TJvaJ+C0
gtvd
t21YfSFD8mhSVVqIlo6/TTbXv6ytb4lGyfLr1Uhq/WrdLWWYLRUFp+GtXl0R
hVMZ
nbUUqq9gr6+wWsTRRj/E9d5hleIsGKuDfD2f5pnSpowU/WAXL0URAw==
=uIbF
-----END PGP SIGNATURE-----


_______________________________________________
Gnupg-devel mailing list
Gnupg-develgnupg.org
h
ttp://lists.gnupg.org/mailman/listinfo/gnupg-devel
[1-3]

about | contact  Other archives ( Real Estate discussion Medical topics )