Vulnerability

    pgp

Affected

    PGP

Description

    Cryptologists  from  Czech  company  ICZ detected serious security
    vulnerability  of  an  international  magnitude.   A  bug has been
    found in  worldwide used  security format  OpenPGP.   The bug  can
    lead  to  discovery  of  user's  private  keys  used  in   digital
    signature  systems.   OpenPGP  format  is  widely  used  in   many
    applications used worldwide, including extremely popular  programs
    like PGP(TM), GNU  Privacy Guard, and  others.  The  bug detection
    comes on the right time, as Philip Zimmermann, the creator of  PGP
    program,  has  left  Network  Associates,  Inc.  and aims to boost
    OpenPGP format in other products for privacy security on Internet.
    From the scientific point of  view, the discovery goes far  beyond
    actual programs - it has wider theoretical and practical impact.

    A  slight  modification  of  the  private  key  file  followed  by
    capturing a  signed message  is enough  to break  the private key.
    These  tasks  can  be  performed  without  knowledge of the user's
    passphrase.   After  that,  a  special  program  can be run on any
    office PC.  Based on  the captured message,the program is  able to
    calculate the user's private key  in half a second.   The attacker
    can then sign any messages instead of the attacked user.   Despite
    of  very  quick  calculation,  the  program  is based on a special
    cryptographic know-how.

    DSA and RSA keys are reportedly equally vulnerable.

    The technical paper is at:

        http://www.i.cz/en/pdf/openPGP_attack_ENGvktr.pdf (PDF, 100 KB)

    "The attack  to private  signature keys  in OpenPGP  format, PGPTM
    program and other OpenPGP based applications" here:

        http://www.i.cz/pdf/pgp/OpenPGP_Attack_ENGfinal.ppt (PPT, 81 kB)

    ICZ's scientists' reactions to criticsm and FAQ

        http://www.i.cz/en/onas/ohlasy.html

    - Attackers have to diddle the secret key.
    - Does *not*  work with commercial  PGP 7.0.3 w/RSA  keys (unknown
      about earlier).
    - Does work with all DSA keys and RSA keys in GPG.

    They found a way how to calculate victims private key from victims
    encrypted  private  key  file  and  at  least  one  signad message
    (signed  by  that  private  key).  It  takes small modification of
    private key file and about half a second of calculation on  commom
    PC.  So to succesfully perform attack their way, you have to:
    1) obtain victims private key file
    2) obtain at least one message signed by above key
    3) have knowleddge and tools those ICZ folks have
    4) apply 3 on 1 and 2

    Attack  takes  advantage  of  missues  of  crypto  algorithms when
    encrytping private key.   They claim OpenPGP  spec is  responsible
    for that missuse.

Solution

    Nothing yet.