1. Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels 2018 Attacks PGP Usenix
    Damian Poddebniak, Christian Dresen, Jens Müller, Fabian Ising, Sebastian Schinzel, Simon Friedberger, Juraj Somorovsky and Jörg Schwenk
    [View PDF on usenix.org]
    [Show BibTex Citation]

    @inproceedings {217634,
    author = {Damian Poddebniak and Christian Dresen and Jens M{\"u}ller and Fabian Ising and Sebastian Schinzel and Simon Friedberger and Juraj Somorovsky and J{\"o}rg Schwenk},
    title = {Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels},
    booktitle = {27th {USENIX} Security Symposium ({USENIX} Security 18)},
    year = {2018},
    isbn = {978-1-939133-04-5},
    address = {Baltimore, MD},
    pages = {549--566},
    url = {https://www.usenix.org/conference/usenixsecurity18/presentation/poddebniak},
    publisher = {{USENIX} Association},
    month = aug,

OpenPGP and S/MIME are the two prime standards for providing end-to-end security for emails. We describe novel attacks built upon a technique we call malleability gadgets to reveal the plaintext of encrypted emails. We use CBC/CFB gadgets to inject malicious plaintext snippets into encrypted emails. These snippets abuse existing and standard conforming backchannels to exfiltrate the full plaintext after decryption. We describe malleability gadgets for emails using HTML, CSS, and X.509 functionality. The attack works for emails even if they were collected long ago, and it is triggered as soon as the recipient decrypts a single maliciously crafted email from the attacker.

We devise working attacks for both OpenPGP and S/MIME encryption, and show that exfiltration channels exist for 23 of the 35 tested S/MIME email clients and 10 of the 28 tested OpenPGP email clients. While it is advisable to update the OpenPGP and S/MIME standards to fix these vulnerabilities, some clients had even more severe implementation flaws allowing straightforward exfiltration of the plaintext.