Anyone using PGP to encrypt their email could have their messages exposed thanks to a severe vulnerability for which there's no proper fix. That's according to researchers in Germany, who said anyone using plug-ins allowing simple use of PGP should stop using them entirely and possibly delete them too.
The warning came from Sebastian Schinzel, lead of the IT security lab at the Münster University of Applied Sciences, who noted attacks exploiting the vulnerability "might reveal the plaintext of encrypted emails, including encrypted emails sent in the past." Though he isn't revealing the full details until Tuesday May 15, the findings have spooked security conscious folk.
The Electronic Frontier Foundation (EFF) said it had reviewed the research and could "confirm that these vulnerabilities pose an immediate risk to those using these tools for email communication, including the potential exposure of the contents of past messages."
"Until the flaws described in the paper are more widely understood and fixed, users should arrange for the use of alternative end-to-end secure channels, such as Signal, and temporarily stop sending and especially reading PGP-encrypted email," the EFF wrote in a blog post.
The EFF has also offered guidance on how to remove plug-ins associated with PGP email, which users can find in the blog. Those plug-ins include ones for clients Apple Mail, Thunderbird and Outlook. It's currently unclear if web services like Protonmail, which use a form of PGP, are affected.
It appears the vulnerability (which some have dubbed eFail) resides in such email clients, rather than a fundamental problem with the PGP standard, according to Werner Koch, the man behind GNUPrivacyGuard (GnuPG), the free and open source PGP software suite. In a post, Koch said he believed the EFF's comments on the issue were "overblown" and that he hadn't been contacted about the vulnerability.
PGP was long seen as the standard for encrypted messaging and it remains the most popular method of sending private email. Increasingly, however, mobile apps like Signal, Apple's iMessage and Threema have provided simple methods for end-to-end encrypted communications.
Schinzel hadn't responded to a request for comment at the time of publication. He's done significant work on cryptographic weaknesses in the past; in 2016, he co-created an attack dubbed DROWN (Decrypting RSA with Obsolete and Weakened eNcryption), which could decrypt people's web connections on 33 per cent of all HTTPS websites.
A trick to decrypt
The researchers explained in a website for the eFail vulnerability that it required the attacker to be able to intercept and email and tamper with it to reveal the plaintext of messages. "In a nutshell, eFail abuses active content of HTML emails, for example externally loaded images or styles, to exfiltrate plaintext through requested URLs," they wrote.
"The attacker changes an encrypted email in a particular way and sends this changed encrypted email to the victim. The victim's email client decrypts the email and loads any external content, thus exfiltrating the plaintext to the attacker."