[Announce] Attack against OpenPGP encryption

[R.A. Hettinga]

--- begin forwarded text


Date: Thu, 10 Feb 2005 20:00:17 -0500
From: David Shaw <dshaw at jabberwocky.com>
To: announce at gnupg.org
OpenPGP: id=99242560; url=http://www.jabberwocky.com/david/keys.asc
User-Agent: Mutt/1.5.7i
Cc:
Subject: [Announce] Attack against OpenPGP encryption
Sender: gnupg-announce-bounces at gnupg.org

Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="IMjqdzrDRly81ofr"
Content-Disposition: inline

Last night, Serge Mister and Robert Zuccherato published a paper
reporting on an attack against OpenPGP symmetric encryption.

This attack, while very significant from a cryptographic point of
view, is not generally effective in the real world.  To be specific,
unless you have your OpenPGP program set up as part of an automated
system to accept encrypted messages, decrypt them, and then provide a
response to the submitter, then this does not affect you at all.

There is a very good writeup on the attack that goes into more depth
at http://www.pgp.com/library/ctocorner/openpgp.html

There will undoubtedly be further discussion of this over the next
several days, but I wanted to provide a few comments now, to try and
answer some questions that may arise:

1) This is not a bug in any particular OpenPGP implementation (GnuPG,
   PGP, Hushmail, etc).  Rather, this is an attack against the OpenPGP
   protocol itself.

2) The attack requires an average of 32,768 probes to get two bytes of
   plaintext.  This is why it is completely ineffective against
   human beings, who will presumably wonder why a stranger wants them
   to decrypt thousands and thousands of messages that won't decrypt,
   and then tell them what errors were seen.

3) It might be effective against an automated process that
   incorporates OpenPGP decryption, if that process returns errors
   back to the sender.

4) The OpenPGP Working Group will be discussing this issue and coming
   up with an effective and permanent fix.  In the meantime, I have
   attached two patches to this mail.  These patches disable a
   portion of the OpenPGP protocol that the attack is exploiting.
   This change should not be user visible.  With the patch in place,
   this attack will not work using a public-key encrypted message.  It
   will still work using a passphrase-encrypted message.  These
   patches will be part of the 1.2.8 and 1.4.1 releases of GnuPG.

5) The full paper is available at http://eprint.iacr.org/2005/033
   It's a great piece of work.

David




_______________________________________________
Gnupg-announce mailing list
Gnupg-announce at gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-announce

--- end forwarded text


-- 
-----------------
R. A. Hettinga <mailto: rah at ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com