Azure Information Protection affected by efail

Question

Hello everyone,&nbsp;does anyone know if there is an official statement from Microsoft if the email encryption in AIP is affected by the new security issue efail?

losercore · Answer

Sorry for the delay. Our terminology makes this confusing.&nbsp; Office 365 Message Encryption (OME) uses RMS.&nbsp; S/MIME is another way of encrypting messages in Exchange Online using certificates and creates digital signatures.&nbsp; The vulnerability described does not apply to RMS (AIP) thus, it does not apply to OME.
&nbsp;
I hope that helps.
&nbsp;
Thanks&nbsp;

losercore · Answer

Hello, I have not seen an official announcement, but AIP is not affected by efail.&nbsp; Efail is a S/MIME/PGP vulnerability has nothing to do with AIP.&nbsp; AIP encrypts at the document level using Rights Management.
&nbsp;
&nbsp;
EDIT:Typo

frederik lentjes · Answer

Thanks for your answer.&nbsp;Just to be sure that we are talking about the same things.&nbsp;I am just searching for a confirmation that Office 365 Message Encryption (part of AIP) is not affected by efail. In my opinion it is just not affected because it is not based on S/MIME or openPGP.&nbsp;Am i right?

jay frantz · Answer

Just to be clear, the S/MIME and PGP vulnerabilities described are due to malleability.&nbsp;Has there been a statement by Microsoft about whether the encryption protocol used in RMS could be subject to&nbsp;malleability-based attacks (i.e. is RMS secure against allowing injection of content into encrypted messages that will still show up on the client side when decrypted into plaintext)?&nbsp;EDIT: In reading further on Efail, it looks like you also need client-side software configured to open things in a fairly careless way. Please disregard my query.

frederik lentjes · Answer

I did not find any official Statement by Microsoft.

Forum Discussion

Azure Information Protection affected by efail

5 Replies