Armored data handling in GnuPG is lax (and/or OpenPGP format syntax for that is ambiguous).
An attacker can craft a One-Pass Signed Message (data + signature) which is looks like signature by BEGIN PGP SIGNATURE and END PGP SIGNATURE, and prepend fake information with malformed BEGIN PGP SIGNED MESSAGE (say, with an additional hyphen before the new line control character). Users misinterpret as if it's a correct signed message with valid head, and could be deceived.
| Status | Assigned | Task | ||
|---|---|---|---|---|
| Restricted Maniphest Task | ||||
| Testing | None | T7902 OpenPGP Cleartext Signature Framework |
Mitigation would be: adding context validation in add_onepass_sig function, which checks WHAT of armored input.
Here is a patch (revised since the email of mine):
Validation is added at parse_onepass_sig function. (Before the revise, I did at add_onepass_sig, but to minimize the change, this is better.)
Here is a revised patch (hopefully the last one):
Error in parsing is not good, I realized. Instead, armor context is recorded in mainproc context, and it is validated when it's a one-pass signature.
There are a lot of other ways to confuse the user. We can't fix them all because the whole purpose of a cleartext signature is to make it easy to use in legacy environments like an BBS. Modern systems use MIME to handle this in a more stringent specified way. For any use it is stongly suggested to check the actual signed data which is avaialable with the --output options. At least a sanitizing viewer should be used which filters out all escape characters (something like cat -v |less).
https://gnupg.org/blog/20251226-cleartext-signatures.html explains why we have cleartext signatures and how you properly use them. The suggestion of the reporters to remove them entirely is a no-go because there are too many systems (open source or in-house) which rely on that format. If properly used (i.e. using --output to get the signed text) there is no problem. Anyway the suggestion has always been to use detached signatures using two files or PGP/MIME).