What does Modification Detection Code (MDC) in OpenPGP do? The authentication is often done by an HMAC in modern cryptosystems. What does MDC do exactly in OpenPGP and is it a software hack or an algorithmic authentication?

Also, how to force GnuPG to stop on error when the MDC is not checked? Right now it issues a warning and decryptes. That was a basis for a recent attack.
What does MDC do exactly in OpenPGP ?


MDC stands for Modification Detection Code. It's a field of cryptograms aiming at detecting that an encrypted message has been partially tampered with.

Why partially? Because that's the best achievable goal in asymmetric encryption, where it is always possible that an adversary changes a message in its entirety (since encryption requires no secret, only the recipient's public key).

So why does it matter to detect partial tampering if we can't detect total tampering? As illustration, if an adversary knew that a message will be like

connect with password nebulaergpaaelia to the website https://acme.com


and could change it to

connect with password nebulaergpaaelia to the website https://acne.com


then the adversary having registered the domain acne.com stands a chance to intercept the password thru what the recipient will do. Hence the need of an MDC.

OpenPGP has (for most ciphers and all recent ones) a provision for an effective MDC. Problems are:


There are legacy encryption modes without MDC. Thus if a decryption tool allows these legacy ciphers, it must accept to work without MDC.
OpenPGP encryption modes with MDC (that I know) detect message alteration only at the end of the message¹. But decryption tools often can be used as a pipe, spitting the deciphered message before the MDC check. That is per the common Unix design pattern of piping, and is useful for efficiency.
Often a piece of code using OpenPGP acts on the deciphered message irrespective of the later MDC check made later. For example, when the ciphertext is html with embedded URLs, the mere tentative to display it can trigger actions that an adversary can observe, and this allows attacks.


How the MDC is implemented (or not) in OpenPGP depends on the algorithm. None is mentioned in the question, thus I won't dive into the specifics.


  how to force GnuPG to stop on error when the MDC is not checked?


Modern versions (2.2.8 and higher, according to the source code) fail by default. It should suppress file output if the MDC check fails (but can't if output goes thru stdout). All that should be necessary for safety when using GPG thru a command line or thru a well-designed GUI is to


refrain from explicitly disabling MDC check (beware that --ignore-mdc-error can be made a permanent options in a variety of files set up manually or by GUI).
and make decryption output to a named file (rather than using &gt; outputfile or piping) OR avoid using the deciphered output before ensuring that the tool's return code is 0.




¹ Conceivably, an encryption mode could split large messages into blocks of some maximum size each with an MDC, so that a decrypting program using bounded intermediary storage could release a deciphered block only after checking an MDC demonstrating that this block has not been altered and is in proper sequence. That would be safer, but more complex, and would increase ciphertext size to some degree. I do not know that it is used in OpenPGP.