New paper on how to fix #efail style attacks against e2e encrypted email, including OpenPGP and S/MIME. Joint work with @JoergSchwenk @lambdafu @dues__ @jensvoid @jurajsomorovsky @seecurity. To be presented at @acm_ccs 2020. Thread: 
One central problem of email e2ee is that neither MIME structure nor header fields are protected from modification. Attackers can send modified ciphertexts, can send ciphertexts with crafted MIME structures or can add or remove headers such as FROM, RCPT TO or SUBJECT at will.
This allows attacks such as those described in efail.de or in arxiv.org/abs/1904.07550. So far, the mail clients mostly implemented ad hoc countermeasures that don't address the root causes the attacks.
We present a generic countermeasure that checks the "decryption context“ including SMTP headers and the MIME structure. The decryption context is encoded as a string and used as Associated Data in the AEAD encryption scheme.
The decryption context changes when attacks alters the email source code in a critical way. This leads to an invalid AEAD auth tag after decryption, which reliably detects the modification. The dc policy even allows the sender to define allowed modifications to the original email
Our proposed solution does not cause any interoperability problems and legacy emails can still be decrypted. We implemented and tested the decryption contexts in Thunderbird/Enigmail and measured the email transport over all major email providers.
The paper is here: dl.acm.org/doi/10.1145/33…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
