Subject: Re: security fixes (KDF, MDC->MAC)?

From: [email-masked]
Date: Fri, 27 Sep 2002 10:05:51 +0200

> Hello OpenPGP,
> 
> Is there interest in fixing the security flaws discussed in the recent
> "security analysis" thread? -
> 
> (1) the Integrity Protected Data and MDC Packets fail to stop Schneier et
> al's attack, because the ciphertext blocks can be pasted into a
> non-integrity protected packet (ie ciphertext from a tag 18 packet can be
> placed in a tag 9 packet, evading the MDC).

5.13.
[...]    Unlike the Symmetrically Encrypted Data Packet, no
   special CFB resynchronization is done after encrypting this prefix
   data.

doesn't this prevent converting packet 18 to 9 ?

__
Disastry  http://disastry.dhs.org/
http://disastry.dhs.org/pgp
 ^----PGP 2.6.3ia-multi06 (supports IDEA, CAST5, BLOWFISH, TWOFISH,
      AES, 3DES ciphers and MD5, SHA1, RIPEMD160, SHA2 hashes)

---

From: Werner Koch <[email-masked]>
Date: Fri, 27 Sep 2002 16:09:13 +0200

> doesn't this prevent converting packet 18 to 9 ?

Yes.

Even more important is that we push users towards using the MDC feature
so that we eventually can make the "no MDC used" warning an
error. (well, with an option to ignore it so that old message can still
be decrypted)

Shalom-Salam,

   Werner