Hacker News Reader

Comment by upofadown | Hacker News Reader

You still get the regular PGP integrity protection even in a case where there is no authentication. I just tried it and pass just sent along the GPG error:

    gpg: WARNING: encrypted message has been manipulated!

... instead of the password file I modified.

View on HN

1. What did you try exactly?

2. How is this “regular integrity protection” defined formally?

I modified a byte in the encrypted data. It then failed the modification detection code (MDC) as defined by RFC-4880. My article:

* https://articles.59.ca/doku.php?id=pgpfan:mdc

It's still very unclear (having spent a few minutes on the RFC) what it does exactly. It sounds like a mechanism to detect accidental errors (say, user copy-pasting encrypted data incorrectly or passing some garbage in place of ciphertext) and not maliciously crafted modifications. More like error correcting code than authentication.

The fact that it detects one byte being modified means nothing.

In the case of pass, no authentication is normally done, so what remains has to be an integrity check. Pass can sign git commits, but OpenPGP signs the content directly, so the MDC is not used.

The encryption mode normally used in OpenPGP is an improved version of cipher feedback (OCFB) for the block mode and something called the modification detection code (MDC) to detect modification. The two (OCFB-MDC) work together to produce an authenticated encryption mode based on shared knowledge of the symmetrical encryption key. In practice few seem to bother with the MDC but it is there and is cryptographically strong should an implementer want to use it for preventing, say, EFAIL.

Reply on news.ycombinator.com