News for hackers. Stuff that matters.

A comment on GnuPG 2.2.23. Parent comment

Re:GnuPG 2.2.23 by dependenttypes on Friday September 04, 2020 @01:22PM (#24376936)
GPG adds something that they call MDC, which is kinda similar to a mac in authenticated encryption schemes. It is enabled by default.
[ Parent | on HN ]
Re:GnuPG 2.2.23 by XMPPwocky on Friday September 04, 2020 @01:42PM (#24377147)
The MDC scheme exists- it's also sketchy as all hell. Wouldn't trust it if serious adversaries are a reasonable threat for you.

https://github.com/gpg/gnupg/blob/master/g10/mainproc.c

[ Parent | on HN ]
Re:GnuPG 2.2.23 by upofadown on Friday September 04, 2020 @04:25PM (#24378556)
Yeah, MDC was added as something better than nothing for unsigned messages/files. It has ended up being remarkably robust over the years, considering. The biggest deal is that you can entirely remove it. As a result stuff these days tends to consider a missing MDC as an invalid MDC.
[ Parent | on HN ]