Message Signature Bypass Affecting openpgp package, versions <4.2.0

openpgp is a JavaScript implementation of the OpenPGP protocol.

Affected versions of this package are vulnerable to Message Signature Bypass. OpenPGP defines several types of signatures with each type carrying a different semantic. Signatures are implemented as packets and each signature packet can contain subpackets.

To indicate a message signature (e.g. a signed e-mail), the signature type “text” is used. The text signature packet verifies both its subpackets as well as the signed text.

During verification of a message signature, OpenPGP.js does not verify that the signature is of type text. An attacker could therefore construct a message that, instead of a text signature, contains a signature of another type. As the input required for the verification process depends on the signature type, an attacker could use a signature with a type that only verifies its subpackets and does not require additional input.

An attacker could construct a message that contains a valid “standalone” or “timestamp” signature packet signed by another person. OpenPGP.js would incorrectly assume this message to be signed by that person.

• GitHub Commit
• GitHub PR
• GitHub Release
• Research Paper (BSI Germany)
• Sec-Consult Blog Post