Most encrypted data formats have plaintext headers, because, how the heck are you supposed to know anything about the encrypted file – such as which encryption tool protected it – without some plaintext info? But this creates a serious security problem.

The plaintext may reveal how many recipients can decrypt the data, and possibly their identities. Info about the encryption software configuration and version level can be used to fingerprint a specific endpoint, facilitating targeted attacks against system weaknesses.

Read full news article on ZDNet