I'm a little confused. Is this an attack on the PGP protocol or just an attack on the software implementation of PGP?
The advice they give seems to indicate that somehow a well-crafted payload can expose the secret PGP key from "tools that automatically decrypt PGP-encrypted email."
This seems to me that it is an implementation-level attack and not a protocol attack on the basis for PGP. Is anyone else getting that same thought?
This is what I thought as well. The EFF warning was specifically against decrypting messages so I think it's unlikely to be a protocol vulnerability. But my experience with software exploits is limited to reading publications about exploits.
The advice they give seems to indicate that somehow a well-crafted payload can expose the secret PGP key from "tools that automatically decrypt PGP-encrypted email."
This seems to me that it is an implementation-level attack and not a protocol attack on the basis for PGP. Is anyone else getting that same thought?