Feature suggestion: options to require MDC or trusted signature on decryption
patrick at enigmail.net
Fri Jun 1 08:46:03 CEST 2018
On 31.05.18 20:44, Werner Koch wrote:
> On Thu, 31 May 2018 16:51, patrick at enigmail.net said:
>> May I suggest that for GnuPG 2.3 you implement some more rules? For example:
>> * refuse encrypting emails if MDC is not enabled in the key prefs
> RFC-4880 can be read to allow using MDC even without the feature flag.
> For RFC-4880bis non-MDC will be deprected:
> This packet is obsolete. An implementation MUST not create this
> packet. An implementation MAY process such a packet but it MUST
> return a clear diagnostic that a non-integrity protected packet has
> been processed. The implementation SHOULD also return an error in
> this case and stop processing.
>> * remove options like --ignore-mdc-error, --ignore-mdc-warning and
>> --allow-multiple-messages, or at least require them to be combined
>> with something like --dangerous-options
> Already done. The MDC options in 2.3 and 2.2 are now NOPs. The
> allow-multiple options and the --pgpg6 options are NOPs in 2.3. For
> testing --rfc2440 can be used which has always had the effect not to
> create an MDC.
But then you contradict yourself. You wrote that gpg prints the
following messages, but ignore-mdc-error is now a NOP:
gpg: WARNING: message was not integrity protected
gpg: Hint: If this message was created before the year 2003 it is
likely that this message is legitimate. This is because back
then integrity protection was not widely used.
**gpg: Use the option '--ignore-mdc-error' to decrypt anyway.**
[GNUPG:] ERROR nomdc_with_legacy_cipher 152
gpg: decryption forced to fail!
More information about the Gnupg-devel