EFAIL

EFAIL is the name given to attacks on some OpenPGP and S/MIME email-encryption implementations disclosed in 2018. The research examined ways in which modified ciphertext and email-client processing could expose plaintext.

Research

The authors described direct exfiltration channels and vulnerabilities connected to the handling of encrypted email content. Their paper was published at the 27th USENIX Security Symposium.

The findings concerned particular implementation and configuration choices rather than a single universal break of the OpenPGP or S/MIME standards. The scope of impact therefore varied among email clients and deployment settings.

Response

Security guidance focused on updating affected software, disabling vulnerable plugin behavior where necessary, and improving authenticated-encryption and message-rendering defenses. The disclosure also sparked debate about communication of risk to encrypted-email users.

Timeline

• 2018-05-13EFAIL is publicly announced.
• 2018The EFAIL research is published at USENIX Security 2018.