What's up John­ny? – Co­vert Con­tent At­tacks on Email End-to-End En­cryp­ti­on

  • We show practical attacks against OpenPGP and S/MIMEencryption and digital signatures in the context of email. Instead of tar-geting the underlying cryptographic primitives, our attacks abuse legiti-mate features of the MIME standard and HTML, as supported by emailclients, to deceive the user regarding the actual message content. Wedemonstrate how the attacker can unknowingly abuse the user as a de-cryption oracle by replying to an unsuspicious looking email. Using thistechnique, the plaintext of hundreds of encrypted emails can be leakedat once. Furthermore, we show how users could be tricked into signingarbitrary text by replying to emails containing CSS conditional rules.An evaluation shows that "out of" OpenPGP-capable email clients,as well as "out of" clients supporting S/MIME, are vulnerable to atleast one attack. We provide different countermeasures and discuss theiradvantages and disadvantages.

Export metadata

Additional Services

Metadaten
Author:Jens Müller, Marcus Brinkmann, Damian Poddebniak, Sebastian Schinzel, Jörg Schwenk
Parent Title (German):17th In­ter­na­tio­nal Con­fe­rence on Ap­p­lied Cryp­to­gra­phy and Net­work Se­cu­ri­ty (ACNS 2019)
Document Type:Conference Proceeding
Language:German
Date of Publication (online):2019/05/21
Year of first Publication:2019
Publishing Institution:Fachhochschule Münster - University of Applied Sciences
Release Date:2019/05/21
First Page:1
Last Page:18
Faculties:Elektrotechnik (ETI)
Publication list:Schinzel, Sebastian
Licence (German):License LogoBibliographische Daten