No, in 2018 you don’t get to claim the high ground and blame users and implementations if your crypto API returns the plaintext on a decryption error.
At most you can say “sorry we are a legacy system, no one knew better then, it’s time to migrate off”.
At most you can say “sorry we are a legacy system, no one knew better then, it’s time to migrate off”.
thisisfine.jpg lists.gnupg.org/pipermail/gnup… 
I really don’t get the community’s negative reaction. This is a perfect case study for proper AEADs, safe APIs, and against secure email in general.
[0] days since retrofitting security on top of a complex existing system blew up.
And wait, apparently you can even strip the authentication tag outright, downgrading the decryption error to just a warning?!
The GnuPG (v2.2.7) command line tool is also happy to create the plaintext output file when the authentication tag is missing (or stripped).
Only a warning and a non-zero exit code.
Only a warning and a non-zero exit code.
