Flaw found in encrypted e-mail programs
There is a fundamental flaw in numerous popular encrypted e-mail programs that calls into question the authenticity of digitally signed and encrypted e-mail messages, according to a security researcher who has published a paper on the subject.
But, as is usually the case in the security community, the revelation has sparked a debate over the merits of the disclosure.
The problem lies in the way that secure mail programs handle digital signatures and encryption. Because encrypted mail messages are necessarily stamped with a digital signature before they are encrypted, the recipient can only be sure who wrote the message and not who encrypted it, according to Don Davis, corporate security architect at Curl Corp., in Cambridge, Mass., and the author of the paper.
For example, if a salesman sends his confidential customer list to a co-worker via encrypted e-mail, the recipient could decrypt the message using his private key, re-encrypt it using a competitor's public key and then send it off to the competitor. The message would then appear to have been sent by the original author.
However, this method would only work if the original message did not contain a salutation, such as "Dear Bill." In his paper, Davis proposes several fixes for the problem, including signing the recipient's name into the plaintext before encryption; encrypting the sender's name into the plaintext; or signing again the already signed and encrypted message. Also, as Davis acknowledges, this is a known problem. He maintains, however, that the widespread adoption of PKI and encrypted e-mail have greatly increased the scope of the issue.
"All of these secure mail programs were written a different stage in the Internet's history, when it was assumed that users would be sophisticated enough to know what information to put in the message body and the header," Davis said. "Users now aren't qualified to make that judgment."
Davis posted his paper to the Bugtraq security mailing list on Saturday, touching off a heated debate about whether the problem is actually in the cryptography employed by programs such as Pretty Good Privacy and Privacy Enhanced Mail or in the protocol with which they are implemented. The argument is simply one of semantics, Davis contends, and does not change the core thesis of his paper.
But others feel that the flaw is just one more in an unending string of such discoveries.
"This is something that should be fixed, but would I recall PGP in order to fix it? No," said Bruce Schneier, noted cryptographer and chief technology officer at Counterpane Internet Security Inc. in Cupertino, Calif. "There's a feeling that these security products are magic, but that's not true. Every piece of security software has these problems. You find one, and there are still a hundred others out there."
Davis will present his paper at the Usenix Technical Conference Thursday in Boston.
