Last night, Serge Mister and Robert Zuccherato published a paper reporting on an attack against OpenPGP symmetric encryption. This attack, while very significant from a cryptographic point of view, is not generally effective in the real world. To be specific, unless you have your OpenPGP program set up as part of an automated system to accept encrypted messages, decrypt them, and then provide a response to the submitter, then this does not affect you at all. There is a very good writeup on the attack that goes into more depth at http://www.pgp.com/library/ctocorner/openpgp.html There will undoubtedly be further discussion of this over the next several days, but I wanted to provide a few comments now, to try and answer some questions that may arise: 1) This is not a bug in any particular OpenPGP implementation (GnuPG, PGP, Hushmail, etc). Rather, this is an attack against the OpenPGP protocol itself. 2) The attack requires an average of 32,768 probes to get two bytes of plaintext. This is why it is completely ineffective against human beings, who will presumably wonder why a stranger wants them to decrypt thousands and thousands of messages that won''t decrypt, and then tell them what errors were seen. 3) It might be effective against an automated process that incorporates OpenPGP decryption, if that process returns errors back to the sender. 4) The OpenPGP Working Group will be discussing this issue and coming up with an effective and permanent fix. In the meantime, I have attached two patches to this mail. These patches disable a portion of the OpenPGP protocol that the attack is exploiting. This change should not be user visible. With the patch in place, this attack will not work using a public-key encrypted message. It will still work using a passphrase-encrypted message. These patches will be part of the 1.2.8 and 1.4.1 releases of GnuPG. 5) The full paper is available at http://eprint.iacr.org/2005/033 It''s a great piece of work. David _______________________________________________ Gnupg-announce mailing list Gnupg-announce@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-announce
Last night, Serge Mister and Robert Zuccherato published a paper reporting on an attack against OpenPGP symmetric encryption. This attack, while very significant from a cryptographic point of view, is not generally effective in the real world. To be specific, unless you have your OpenPGP program set up as part of an automated system to accept encrypted messages, decrypt them, and then provide a response to the submitter, then this does not affect you at all. There is a very good writeup on the attack that goes into more depth at http://www.pgp.com/library/ctocorner/openpgp.html There will undoubtedly be further discussion of this over the next several days, but I wanted to provide a few comments now, to try and answer some questions that may arise: 1) This is not a bug in any particular OpenPGP implementation (GnuPG, PGP, Hushmail, etc). Rather, this is an attack against the OpenPGP protocol itself. 2) The attack requires an average of 32,768 probes to get two bytes of plaintext. This is why it is completely ineffective against human beings, who will presumably wonder why a stranger wants them to decrypt thousands and thousands of messages that won''t decrypt, and then tell them what errors were seen. 3) It might be effective against an automated process that incorporates OpenPGP decryption, if that process returns errors back to the sender. 4) The OpenPGP Working Group will be discussing this issue and coming up with an effective and permanent fix. In the meantime, I have attached two patches to this mail. These patches disable a portion of the OpenPGP protocol that the attack is exploiting. This change should not be user visible. With the patch in place, this attack will not work using a public-key encrypted message. It will still work using a passphrase-encrypted message. These patches will be part of the 1.2.8 and 1.4.1 releases of GnuPG. 5) The full paper is available at http://eprint.iacr.org/2005/033 It''s a great piece of work. David _______________________________________________ Gnupg-announce mailing list Gnupg-announce@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-announce