Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels
summary
Research demonstrates a concrete break of end-to-end email encryption by injecting chosen plaintext into encrypted messages and triggering network callbacks from clients on decryption. The attack uses CBC/CFB malleability gadgets to insert HTML/CSS/image/OCSP payloads that form self‑exfiltrating plaintext, works against archived messages, and fires as soon as a crafted message is opened. Practical tests show 23 of 35 S/MIME clients and 10 of 28 OpenPGP clients possess exploitable backchannels or implementation flaws; fixes require authenticated encryption and client-side handling changes.
AI-written summary · about
chapters (9)
- 0:00Intro
- 0:33Motivation for email encryption
- 2:30Security of email encryption
- 3:11Backchannel techniques
- 6:45Malleability of CBC
- 9:15Attacking S/MIME
- 10:40Attacking OpenPGP
- 15:20Impact on the standards
- 16:07Conclusions
related talks
37mContent-Type: multipart/oracle – Tapping Into Format Oracles in...
44mHow to Break PDF Encryption
40mStealing With Style: Using CSS to Exploit ProtonMail & Friends
36mSmall Leaks, Billions Of Dollars: Practical Cryptographic Exploits That Undermine Crypto Wallets
44mBeyond End to End Encryption
54mBroken Crypto is Broken
44mModern Email Security
14mWhen Encryption Fails