Re: message integrity checksum?

[Gary Howland <gary@xxxxxxxxxxx>]

> 
> Gary Howland discussed PGP vulnerabilities at HIP97 I think.  One of
> the vulnerabilities was that encrypted (but not signed) messages could
> be altered undetectably.
> 
> This can be demonstrated (with pgp2.6 command line):
> 
> % echo hello world > junk
> % pgp -c +compress=off -zfred junk
> % sed 's/....$/adam/' < junk.pgp > junk2.pgp
> % pgp -zfred junk2.pgp
> % cat junk2
> hello wo<F8>P?t
> 
> (pgp doesn't complain or even notice the above ... there is no
> checksum and so you can just garble the file, if you so wish, and pgp
> won't complain).
> 
> Was this viewed as a problem?
> 
> I think the example given is that someone might use this (symmetric
> encryption) to send commands to a remote command executer which would
> be trusted because it was encrypted with a shared passphrase.  This
> shows that the last command say could be garbled, resulting in a null
> operation and potential security problem.

With known plaintext, the last 8 bytes can be set to anything the attacker 
desires - so it's not just a case of removing or randomly corrupting data.

You can find the paper for the talk at:

	http://www.hotlava.com/doc/index.html


Gary