61 votes

Is the software that uses PGP broken, or is it PGP itself?

Usenix Paper, replacing earlier draft at efail.de. TL;DR: the vulnerability is in some popular email client software, often combined with an extension simplifying the use of an OpenPGP (e.g. GnuPG) or ...
fgrieu's user avatar
  • 141k
53 votes

Is the software that uses PGP broken, or is it PGP itself?

There are a few parts to the EFAIL attacks. Some parts are the fault of the mailer authors for exposing unnecessary attack surface via arbitrary incoming email. Some parts are the fault of the ...
Squeamish Ossifrage's user avatar
3 votes

Why does 3DES need private key to decrypt?

Yes, 3DES is a symmetric cipher and you use a secret key for both encryption and decryption with it. However, that is not the same thing as the keys used in RSA or other public key cryptography – you ...
otus's user avatar
  • 32.1k
1 vote

Does CMS AuthEnvelopedData type provide message authentication?

Authentication (and nonrepudiation) is relative to a source. 'Authenticated' encryption like GCM and CCM is a limited form of authentication that guarantees successfully decrypted data came from the ...
dave_thompson_085's user avatar
1 vote

Can I use a government-issued certificate in Outlook?

If your email is indeed in the cert and the key usage is there, you would expect that you can sign with it, providing that: the certificate is compatible with the email client; the signing generation ...
1 vote

Which algorithm to use for S/MIME

The RSA encryption that you seem to be using is specified in PKCS#1, I've linked to the latest version, 2.2: rsaEncryption OBJECT IDENTIFIER ::= { pkcs-1 1 } ...
Maarten Bodewes's user avatar
  • 92.6k

Only top scored, non community-wiki answers of a minimum length are eligible