3
$\begingroup$

The authentication is often done by an HMAC in modern cryptosystems. What does MDC do exactly in OpenPGP and is it a software hack or an algorithmic authentication?

Also, how to force GnuPG to stop on error when the MDC is not checked? Right now it issues a warning and decryptes. That was a basis for a recent attack.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
5
$\begingroup$

What does MDC do exactly in OpenPGP ?

MDC stands for Modification Detection Code. It's a field of cryptograms aiming at detecting that an encrypted message has been partially tampered with.

Why partially? Because that's the best achievable goal in asymmetric encryption, where it is always possible that an adversary changes a message in its entirety (since encryption requires no secret, only the recipient's public key).

So why does it matter to detect partial tampering if we can't detect total tampering? As illustration, if an adversary knew that a message will be like

connect with password nebulaergpaaelia to the website https://acme.com

and could change it to

connect with password nebulaergpaaelia to the website https://acne.com

then the adversary having registered the domain acne.com stands a chance to intercept the password thru what the recipient will do. Hence the need of an MDC.

OpenPGP has (for most ciphers and all recent ones) a provision for an effective MDC. Problems are:

  • There are legacy encryption modes without MDC. Thus if a decryption tool allows these legacy ciphers, it must accept to work without MDC.
  • OpenPGP encryption modes with MDC (that I know) detect message alteration only at the end of the message¹. But decryption tools often can be used as a pipe, spitting the deciphered message before the MDC check. That is per the common Unix design pattern of piping, and is useful for efficiency.
  • Often a piece of code using OpenPGP acts on the deciphered message irrespective of the MDC check made later. For example, when the ciphertext is html with embedded URLs, the mere tentative to display it can trigger actions that an adversary can observe, and this allows attacks.

How the MDC is implemented (or not) in OpenPGP depends on the algorithm. None is mentioned in the question, thus I won't dive into the specifics.

how to force GnuPG to stop on error when the MDC is not checked?

Modern versions (2.2.8 and higher, according to the source code) fail by default. It should suppress file output if the MDC check fails (but can't if output goes thru stdout). All that should be necessary for safety when using GPG thru a command line or thru a well-designed GUI is to

  • refrain from explicitly disabling MDC check (beware that --ignore-mdc-error can be made a permanent options in a variety of files set up manually or by GUI).
  • and make decryption output to a named file (rather than using > outputfile or piping) OR avoid using the deciphered output before ensuring that the tool's return code is 0.

¹ Conceivably, an encryption mode could split large messages into blocks of some maximum size each with an MDC, so that a decrypting program using bounded intermediary storage could release a deciphered block only after checking an MDC demonstrating that this block has not been altered and is in proper sequence. That would be safer, but more complex, and would increase ciphertext size to some degree. I do not know that it is used in OpenPGP.

Improve this answer
$\endgroup$
7
  • $\begingroup$ I see. So rather than encrypt-then-HMAC, the MDC reverses the order doing SHA1-then-encrypt, requiring it to also do decryt-then-SHA1 and that's the issue. $\endgroup$
    – eli
    Apr 20, 2020 at 9:47
  • $\begingroup$ @eli: Your explanation matches how the Modification Detection Code Packet (Tag 19) works. Yes that's not so great a method, yes SHA-1 has weaknesses, and yes HMAC (even with SHA-1 as the base hash) would fix these. But a security problem can still occur in decryption of something properly encrypted with encrypt-then-HMAC (no matter the precautions for bundling encryption and HMAC key), if decryption proceeds and outputs before the HMAC is checked. The underlying problem is decryption-as-a-pipe with integrity check only in the end. $\endgroup$
    – fgrieu-onstrike ♦
    Apr 20, 2020 at 10:20
  • $\begingroup$ With encrypt-then-HMAC ordering, when decrypting, the HMAC is performed and checked first. The issue is programs may not act on a failed authentication because they have to be backward compatible. BTW, I am using the latest GPG (version 2.2.12) and MDC returns only a warning! $\endgroup$
    – eli
    Apr 20, 2020 at 10:33
  • $\begingroup$ I am using 2.2.12, which is older than 2.2.8. So that might be the issue. $\endgroup$
    – eli
    Apr 20, 2020 at 10:57
  • $\begingroup$ @eli: 2.2.12 is not current (2.2.20 is), but it is still after 2.2.8 and thus AFAIK should suppress output coming from a ciphertext without valid MDC, except in pipe mode (that is, output usign > foutfile) or if --ignore-mdc-error is in some config file (gpg.conf perhaps) or command-line option or if the tool is used thru a GUI with an equivalent option. $\endgroup$
    – fgrieu-onstrike ♦
    Apr 20, 2020 at 11:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.