GPG is a command-line implementation of OpenPGP, used to encrypt, decrypt, sign, and verify data. It brought practical end-to-end encryption to email after PGP’s 1991 release and OpenPGP’s 1998 standardization. section 10.3
GPG protects message content, but its design leaves important gaps:
- Email subjects and other headers remain visible, so encryption does not automatically hide metadata such as participants, message lengths, or IP addresses. section 10.3.1
- Unauthenticated encryption can allow an interceptor to tamper with unsigned encrypted email. section 10.3.1
- Careless composition of signing and encryption can enable message redirection or signature substitution. section 10.3.1
- GPG does not provide forward secrecy by default, so a compromised private key can expose earlier encrypted email. section 10.3.1
A message that changes recipients
Alice encrypts and signs a message for Bob. Bob can re-encrypt it for Charles, who may believe Alice originally intended the message for him. Signing the ciphertext does not solve the problem: Bob can remove Alice’s signature and attach his own. section 10.3.1
Figure 10.3 In the top diagram, Alice encrypts a message and signature over the message with Bob’s public key. Bob can re-encrypt this message to Charles, who might believe that it was intended for him to begin with. This is the PGP flow. In the bottom diagram, this time Alice encrypts a message to Charles. She also signs the encrypted message instead of the plaintext content. Bob, who intercepts the encrypted message, can replace the signature with his own, fooling Charles into thinking that he wrote the content of the message.
Compare the two signing flows and see why neither composition reliably binds a message to its intended sender and recipient. section 10.3.1
