{"action":"created","issue":{"url":"https://api.github.com/repos/openpgpjs/openpgpjs/issues/360","labels_url":"https://api.github.com/repos/openpgpjs/openpgpjs/issues/360/labels{/name}","comments_url":"https://api.github.com/repos/openpgpjs/openpgpjs/issues/360/comments","events_url":"https://api.github.com/repos/openpgpjs/openpgpjs/issues/360/events","html_url":"https://github.com/openpgpjs/openpgpjs/pull/360","id":110328005,"number":360,"title":"Add option for deprecation of Symmetrically Encrypted Data Packet (Tag 9)","user":{"login":"toberndo","id":1164474,"avatar_url":"https://avatars.githubusercontent.com/u/1164474?v=3","gravatar_id":"","url":"https://api.github.com/users/toberndo","html_url":"https://github.com/toberndo","followers_url":"https://api.github.com/users/toberndo/followers","following_url":"https://api.github.com/users/toberndo/following{/other_user}","gists_url":"https://api.github.com/users/toberndo/gists{/gist_id}","starred_url":"https://api.github.com/users/toberndo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/toberndo/subscriptions","organizations_url":"https://api.github.com/users/toberndo/orgs","repos_url":"https://api.github.com/users/toberndo/repos","events_url":"https://api.github.com/users/toberndo/events{/privacy}","received_events_url":"https://api.github.com/users/toberndo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-10-07T22:06:03Z","updated_at":"2015-10-21T02:49:43Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/openpgpjs/openpgpjs/pulls/360","html_url":"https://github.com/openpgpjs/openpgpjs/pull/360","diff_url":"https://github.com/openpgpjs/openpgpjs/pull/360.diff","patch_url":"https://github.com/openpgpjs/openpgpjs/pull/360.patch"},"body":"There is a recent analysis of chosen-ciphertext attacks to downgrade a Sym. Encrypted Integrity Protected Data Packet (Tag 18) packet to a plain Symmetrically Encrypted Data Packet (Tag 9).\r\n\r\nThe author Jonas Magazinius points out: \"The implications are among others, that an encrypted and signed message can be stripped of its signature and modified arbitrarily, with certain restrictions, by an attacker without knowing the key.\"\r\n\r\nFull details here: http://www.metzdowd.com/pipermail/cryptography/2015-October/026685.html\r\n\r\nThis seems to be known issue for years. GPG triggers a warning when a tag 9 packet (without integrity protection) is used. But this requires the user to understand the implications. And from a practical perspective tag 9 is never used as all relevant PGP implementations create messages only with integrity protection (tag 18). Then why keep this hole open?\r\n\r\nI propose to deprecate tag 9. With this PR decryption of a message with tag 9 will throw an exception.\r\n\r\nFor legacy use cases there is the config.enforce_integrity_protection which can be set to false and bring back tag 9."},"comment":{"url":"https://api.github.com/repos/openpgpjs/openpgpjs/issues/comments/149766957","html_url":"https://github.com/openpgpjs/openpgpjs/pull/360#issuecomment-149766957","issue_url":"https://api.github.com/repos/openpgpjs/openpgpjs/issues/360","id":149766957,"user":{"login":"cm1313","id":15224318,"avatar_url":"https://avatars.githubusercontent.com/u/15224318?v=3","gravatar_id":"","url":"https://api.github.com/users/cm1313","html_url":"https://github.com/cm1313","followers_url":"https://api.github.com/users/cm1313/followers","following_url":"https://api.github.com/users/cm1313/following{/other_user}","gists_url":"https://api.github.com/users/cm1313/gists{/gist_id}","starred_url":"https://api.github.com/users/cm1313/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cm1313/subscriptions","organizations_url":"https://api.github.com/users/cm1313/orgs","repos_url":"https://api.github.com/users/cm1313/repos","events_url":"https://api.github.com/users/cm1313/events{/privacy}","received_events_url":"https://api.github.com/users/cm1313/received_events","type":"User","site_admin":false},"created_at":"2015-10-21T02:49:43Z","updated_at":"2015-10-21T02:49:43Z","body":"I am getting this error Symmetrically Encrypted Data Packet tag 9 deactivated can anyone help? Idn what to do\r\n"}}