• Noah Misch's avatar
    pgcrypto: Report errant decryption as "Wrong key or corrupt data". · 85270ac7
    Noah Misch authored
    This has been the predominant outcome.  When the output of decrypting
    with a wrong key coincidentally resembled an OpenPGP packet header,
    pgcrypto could instead report "Corrupt data", "Not text data" or
    "Unsupported compression algorithm".  The distinct "Corrupt data"
    message added no value.  The latter two error messages misled when the
    decrypted payload also exhibited fundamental integrity problems.  Worse,
    error message variance in other systems has enabled cryptologic attacks;
    see RFC 4880 section "14. Security Considerations".  Whether these
    pgcrypto behaviors are likewise exploitable is unknown.
    
    In passing, document that pgcrypto does not resist side-channel attacks.
    Back-patch to 9.0 (all supported versions).
    
    Security: CVE-2015-3167
    85270ac7
pgp-decrypt.out 11.2 KB