#612 Check, if claimed sender and signer of an e-mail match

[Erik Nellessen]

A signed e-mail contains a non-authentic, claimed sender and a (n authentic) signer. I attached an example, the claimed sender is marked in blue, the signer in red. The claimed sender is easily interchangeable.

When Enigmail verifies a signature, it checks, if the signature has been done with a key, the user trusts (by using the gpg keyring). It then displays, if the signature is correct and who the signer is.

Anyhow, it does not check, if claimed sender and signer match. I attached an example message, in which Alice is the claimed sender, but the signature has been created by Mallet. As you can see in this example, an attacker can use any key the receiver trusts to create a signature for an e-mail with claimed sender "Alice", which is accepted by Enigmail without any warning.

Of course, the receiver is able to notice the forgery. By comparing claimed sender and signer, we see, that something is wrong. Anyhow, this could be done automatically by Enigmail.

I do not want to claim, that there are no use cases possible, in which claimed sender and signer justifiedly differ. That is why I request as a feature a warning by Enigmail. It should say "Attention, something might be wrong here. I just wanted to tell you, if you know what you're doing, go on.".

[Ludwig Hügelschäfer]

There's a more general solution for this: The proposed Memory Hole standard.

https://www.ietf.org/proceedings/92/slides/slides-92-appsawg-0.pdf

This offers signing/encryption not only of the body text, but also of the E-Mail headers. Enigmail 1.9 already incorporates this function, but you must turn it on manually.

[Erik Nellessen]

This is only a solution if Enigmail only accepts E-Mails which have a signed header. As long as Enigmail also accepts E-Mails with unsigned headers, the attack is possible. Anyhow, not accepting these E-Mails would break backward compatibility.

[Patrick Brunschwig]

There is a general consensus in the OpenPGP email world that the UID should be considered decorative. This is also what the Autocrypt specification suggests. It's not difficult to fake the sender email address, even if you're not the author of the mail.