TY  - CHAP
A1  - Müller, Jens
A1  - Brinkmann, Marcus
A1  - Poddebniak, Damian
A1  - Böck, Hanno
A1  - Schinzel, Sebastian
A1  - Smomrosvsky, Juraj
A1  - Schwenk, Jörg
T1  - “Johnny, you are fired!” – Spoofing OpenPGP and S/MIME Signatures in Emails
T2  - 28th Usenix Security Symposium, Santa Clara, CA, USA
N2  - OpenPGP and S/MIME are the two major standards to en-crypt and digitally sign emails.  Digital signatures are sup-posed to guarantee authenticity and integrity of messages. Inthis work we show practical forgery attacks against variousimplementations of OpenPGP and S/MIME email signatureverification in five attack classes: (1) We analyze edge casesin S/MIME’s container format.  (2) We exploit in-band sig-naling in the GnuPG API, the most widely used OpenPGPimplementation.  (3) We apply MIME wrapping attacks thatabuse  the  email  clients’  handling  of  partially  signed  mes-sages.  (4) We analyze weaknesses in the binding of signedmessages to the sender identity.  (5) We systematically testemail clients for UI redressing attacks.Our attacks allow the spoofing of digital signatures for ar-bitrary  messages  in  14  out  of  20  tested  OpenPGP-capableemail  clients  and  15  out  of  22  email  clients  supportingS/MIME signatures.  While the attacks do not target the un-derlying cryptographic primitives of digital signatures, theyraise  concerns  about  the  actual  security  of  OpenPGP  andS/MIME email applications.  Finally, we propose mitigationstrategies to counter these attacks.
Y1  - 2019
UR  - https://www.usenix.org/conference/usenixsecurity19/presentation/muller
EP  - 18
ER  - 
TY  - CHAP
A1  - Müller, Jens
A1  - Brinkmann, Marcus
A1  - Poddebniak, Damian
A1  - Schinzel, Sebastian
A1  - Schwenk, Jörg
T1  - What's up John­ny? – Co­vert Con­tent At­tacks on Email End-to-End En­cryp­ti­on
T2  - 17th In­ter­na­tio­nal Con­fe­rence on Ap­p­lied Cryp­to­gra­phy and Net­work Se­cu­ri­ty (ACNS 2019)
N2  - We show practical attacks against OpenPGP and S/MIMEencryption and digital signatures in the context of email. Instead of tar-geting the underlying cryptographic primitives, our attacks abuse legiti-mate features of the MIME standard and HTML, as supported by emailclients, to deceive the user regarding the actual message content. Wedemonstrate how the attacker can unknowingly abuse the user as a de-cryption oracle by replying to an unsuspicious looking email. Using thistechnique, the plaintext of hundreds of encrypted emails can be leakedat once. Furthermore, we show how users could be tricked into signingarbitrary text by replying to emails containing CSS conditional rules.An evaluation shows that "out of" OpenPGP-capable email clients,as well as "out of" clients supporting S/MIME, are vulnerable to atleast one attack. We provide different countermeasures and discuss theiradvantages and disadvantages.
Y1  - 2019
SP  - 1
EP  - 18
ER  -