Page MenuHome GnuPG
Create Task
Maniphest T7903

Multiple Plaintext Attack on Detached PGP Signatures in GnuPG
Closed, ResolvedPublic
Actions

Description

An attacker can put a plaintext in detached signature so that a user might see it by gpg --decrypt.
A user could be deceived (or confused, at least).

Revisions and Commits

rG GnuPG
rGb8805d9a0f52 gpg: Error out on unverified output for non-detached signatures.

Related Objects
Search...

StatusAssignedTask
Restricted Maniphest Task
 Resolved• wernerT7903 Multiple Plaintext Attack on Detached PGP Signatures in GnuPG

Event Timeline

• gniibe created this task.Nov 4 2025, 6:41 AM
• gniibe created this object in space Restricted Space.
• gniibe created this object with visibility "g10code (Project)".
• gniibe created this object with edit policy "g10code (Project)".

Fixed in rG8abc320f2a75: gpg: Error out on unverified output for non-detached signatures.

• werner added a subscriber: • werner.Nov 4 2025, 1:25 PM

We have fixed it but the commit also states:

But note: Using the output of the verify command for detached
signatures is useless because with a non-manipulated signature nothing
would haven been written.

• gniibe mentioned this in Unknown Object (Maniphest Task).Nov 10 2025, 2:51 AM
• werner shifted this object from the Restricted Space space to the S1 Public space.Fri, Dec 26, 2:57 PM
• werner changed the visibility from "g10code (Project)" to "Public (No Login Required)".
thesamesam added a subscriber: thesamesam.Fri, Dec 26, 8:40 PM
• werner triaged this task as Normal priority.Mon, Dec 29, 3:46 PM
• werner edited projects, added OpenPGP, Not A Bug; removed g10code, Bug Report.

Note using the output of --decrypt directly on the tty is a Bad Idea(tm). You won't cat arbitrary files to your tty for the same reason.

BTW, if you watched CitizenFour please don't follow the example given in the first scene where someone types gpg -d on the tty.

• werner closed this task as Resolved.Fri, Jan 2, 4:24 PM
• werner claimed this task.
• werner added a commit: rGb8805d9a0f52: gpg: Error out on unverified output for non-detached signatures..Fri, Jan 2, 4:38 PM