bugDistributed Privacy Guard - Bugs: bug #56877, dkg-decrypt should be able to...

 
 

bug #56877: dkg-decrypt should be able to verify intended recipients even when only using a session key

Submitter:  Daniel Kahn Gillmor <dkg>
Submitted:  Mon 09 Sep 2019 03:32:34 PM UTC
   
 
Category:  Source Code Severity:  2 - Minor
Item Group:  Feature Request Status:  In Progress
Privacy:  Public Assigned to:  stamer
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 09 Sep 2019 07:27:52 PM UTC, comment #1: 

There is already an option ("-K, --weak") that allow keys with weak cryptographic parameters for verification of included signatures. It could be reused here.

If no Intended Recipients are defined by a corresponding signature subpacket then no check is done at all.

 Heiko Stamer <stamer>
Group administrator
Mon 09 Sep 2019 03:32:34 PM UTC, original submission:  

over in https://gitlab.com/openpgp-wg/rfc4880bis/merge_requests/19#note_213879442 Heiko and i were discussing how to deal with intended_recipients subpackets when decrypting with only a session key.

one option is to "weaken" the strictness, but i think maybe we need to state what the strictness actually is intended to do in this case.

For example, how strict is the tooling if the decryption is done by a secret key whose corresponding OpenPGP certificate is expired or revoked?  what sort of time bounds are checked?  what happens if no intended_recipients subpacket is present at all?

 Daniel Kahn Gillmor <dkg>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by dkg (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-10-23 stamer Severity3 - Normal 2 - Minor
    2019-10-23 stamer CategoryNone Source Code
        Item GroupNone Feature Request
    2019-09-09 stamer StatusNone In Progress
        Assigned toNone stamer

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.13-ec04.
    Corresponding source code