News for hackers. Stuff that matters.

A comment on EFail – Vulnerabilities in end-to-end encryption technologies OpenPGP and S/MIME. Parent comment

Re:EFail – Vulnerabilities in end-to-end encryption technolo... by sp332 on Monday May 14, 2018 @10:57AM (#17066078)
Relevant comment from Werner Koch: https://twitter.com/FiloSottile/status/996011473112576000

Either GPG buffers the data and checks for DECRYPTION_FAILED, or the application depending on GPG does. Of the two options, it makes much more sense for GPG to handle this.

[ Parent | on HN ]
Re:EFail – Vulnerabilities in end-to-end encryption technolo... by tptacek on Monday May 14, 2018 @11:03AM (#17066128)
This is shades of the curl maintainer rationalizing CURL_SSL_VERIFYHOST=1 not doing any checking, because CURL_SSL_VERIFYHOST=2 does.
[ Parent | on HN ]
Re:EFail – Vulnerabilities in end-to-end encryption technolo... by slrz on Monday May 14, 2018 @04:41PM (#17069258)
The application is likely better equipped to do something reasonable if temporarily storing lots of data is in order.

Still, GnuPG could do the buffering automatically for small messages and force explicit configuration otherwise. The latter might not be realistically enforcable given the compatibility constraints.

[ Parent | on HN ]
Re:EFail – Vulnerabilities in end-to-end encryption technolo... by jwildeboer on Monday May 14, 2018 @04:33PM (#17069187)
DECRYPTION_FAILED should always result with an empty return. Not with the decrypted content.
[ Parent | on HN ]