Subject: Re: MDC Usage

From: "Michael Young" <[email-masked]>
Date: Fri, 27 Oct 2000 11:51:12 -0400

As the name suggests, an MDC helps detect modifications.  Without an MDC,
an attacker has a fair chance of changing the end of the file without it
being noticed.

Suppose I change a byte in the last cipher-block of a "classic PGP" message.
Because PGP uses a CFB mode, this changes the corresponding byte of the
plaintext, and nothing else.  (It would completely change subsequent blocks,
but there aren't any more.)  If the plaintext is human-readable text, there is
a fair chance that this would change one word to another, such that the human
reader won't realize that tampering had occurred.  Worse, if the data has no
internal consistency check (raw binary data), this attack could be applied to
anything after the salt+2 check bytes.  If the message is encoded using the
indeterminate packet length feature, an attacker could also just truncate the
message.

The MDC itself is redundant data that can be used as a consistency check.
The variant on the symmetric data packet is necessary to ensure that
a receiver knows an MDC packet will appear, both so that it can hash
the plaintext as it goes and so that it can detect the MDC being cut off;
it uses a different CFB resync to make it harder to tweak this new packet
into an old one undetected (at which point the MDC could be stripped).

There was a lengthy discussion on the MDC proposal on the mailing list.
(I wasn't reading it at the time, but img.org maintains an archive.)