Newsgroup: it.comp.sicurezza.crittografia
Titolo: GPG: elGamal compromesso quando firma


   sub  1536g/ADF6A6E1 1999-02-20 [expires: 2002-11-01]
   sub  1536G/B5A18FF4 1998-07-07 [expires: 2002-07-06]
   sub  1536R/23D2A63D 2002-07-30 [expires: 2003-12-31]
This my usual working key, which is a standard GnuPG key with some
additional subkeys added over time.  It is a good example because one
subkey was created as type 20 signing and encrypt ElGamal key.  It is
the second subkey:
   sub  1536G/B5A18FF4 1998-07-07 [expires: 2002-07-06]
The capital letter "G" denotes such an possible compromised subkey
whereas the first subkey:
   sub  1536g/ADF6A6E1 1999-02-20 [expires: 2002-11-01]
is a standard encryption-only subkey as indicated by the small letter
"g".  That key is not affected.
The keys denoted with this capital letter "G" should be REVOKED unless
you are definitely sure those subkeys were never used to create a
signatures with GnuPG >= 1.0.2.
How to revoke a key:
====================
To create a revocation certificate for the entire key (primary and
all subkeys), you do:
  gpg --gen-revoke your_keyid >foo.rev
If you have lost access to your passphrase, hopefully you have a
pre-manufactured revocation certificate (either on a floppy or printed
on a sheet of paper) which you may the use instead of the above
command.
This revocation certificate should then be imported into
GnuPG using:
   gpg --import <foo.rev
now export your key to a file and distribute it to the keyservers.
   gpg --export -a your_keyid >mykey.asc
   gpg --keyserver 
subkeys.pgp.net
 --send-keys your_keyid
If your primary key is not an ElGamal key, you might need to revoke a
subkey.  Note again that only type 20 ElGamal keys (denoted by a
capital letter "G") require revocation - the standard ElGamal
encrypt-only key (small g) is perfectly fine.  Use gpg's edit command
like this:
   $ gpg --edit-key xyzxyzxy
The key listing will be shown. Select the subkey you want to revoke,
using the command "key 2" (or whatever subkey it is) and then enter
the command "revkey" and follow the prompts.  Continue then with an
export as described above.
How many keys are affected?
===========================
I can't tell for sure.  According to the keyserver statistics, there
are 848 primary ElGamal signing keys which are affected.  These are a
mere 0.04 percent of all primary keys on the keyservers.  There are
324 vulnerable subkeys on the keyservers, too.
Some of the subkeys might have never been used for signing because for
some time in the past GnuPG created the encryption subkey as type 20
but didn't used it for signing because the DSA primary key was used
instead.  It is better to revoke such keys nevertheless.
Note again that the standard configuration of GnuPG does not allow
creating the vulnerable sign+encrypt ElGamal keys and that neither DSA
(type 17), RSA (type 1) nor ElGamal encrypt-only keys (type 16) are
affected.
Thanks
======
Phong Nguyen [4] analyzed the implementation of GnuPG's cryptographic
parts and found this vulnerability.  He also developed actual code to
mount the attack and was so kind to give me enough time to have a look
at his paper and to gather a list of known type 20 keys owners.
I am really sorry for this,
    Werner
[1] To get a fresh key you might want to consult the keyservers or get
     it from using "finger wk at 
g10code.com
" or "finger dd9jn at 
gnu.org
".
[2] See 
http://lists.gnupg.org/mailman/listinfo/gnupg-users
 .
[3] The patent status of DSA was not clear when I started to write
     GnuPG back in 1997.
[4] Working at the French National Center for Scientific Research and
     the Ecole normale superieure: 
http://www.di.ens.fr/~pnguyen/
 .
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
iD8DBQE/xavwaLeriVdUjc0RAquhAJ9crSJ2j8EbqaAnbJGoXBsgERPLaACePwcP
70laYWsyhXkzVgqL2X4ELVk=
=xGWG
-----END PGP SIGNATURE-----











  gpg --gen-revoke your_keyid >foo.rev


   gpg --import <foo.rev




   $ gpg --edit-key xyzxyzxy





Thanks
======


    Werner

     it from using "finger 
w...@g10code.com
" or "finger 
dd...@gnu.org
".
[2] See 
http://lists.gnupg.org/mailman/listinfo/gnupg-users
 .
[3] The patent status of DSA was not clear when I started to write
     GnuPG back in 1997.
[4] Working at the French National Center for Scientific Research and
     the Ecole normale superieure: 
http://www.di.ens.fr/~pnguyen/
 .
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
iD8DBQE/xavwaLeriVdUjc0RAquhAJ9crSJ2j8EbqaAnbJGoXBsgERPLaACePwcP
70laYWsyhXkzVgqL2X4ELVk=
=xGWG
-----END PGP SIGNATURE-----
-- 
L a p o   L u c h i n i
l a p o @ l a p o . i t
w w w . l a p o . i t /
http://www.megatokyo.it