Re: [Announce] [security fix] GnuPG 1.4.14 released
Cancel that. My fault ... I'd missed that I had some old libraries installed. ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: [Announce] [security fix] GnuPG 1.4.14 released
On Fri, Jul 26, 2013 at 2:40 AM, Richard Outerbridge ou...@interlog.comwrote: Werner: No problems. MacBookPro9,1; Mountain Lion OS X 10.8.4 (12E55) Xcode 4.6.3 __outer For some reason I get the following error when trying to build on Mountain Lion OS X: gcc -g -O2 -Wall -Wno-pointer-sign -o gpg gpg.o build-packet.o compress.o compress-bz2.o free-packet.o getkey.o keydb.o keyring.o seskey.o kbnode.o mainproc.o armor.o mdfilter.o textfilter.o progress.o misc.o openfile.o keyid.o parse-packet.o status.o plaintext.o sig-check.o keylist.o signal.o cardglue.o tlv.o card-util.o app-openpgp.o iso7816.o apdu.o ccid-driver.o pkclist.o skclist.o pubkey-enc.o passphrase.o seckey-cert.o encr-data.o cipher.o encode.o sign.o verify.o revoke.o decrypt.o keyedit.o dearmor.o import.o export.o trustdb.o tdbdump.o tdbio.o delkey.o keygen.o pipemode.o helptext.o keyserver.o photoid.o exec.o ../cipher/libcipher.a ../mpi/libmpi.a ../util/libutil.a -liconv -lresolv ../intl/libintl.a -liconv -Wl,-framework -Wl,CoreFoundation -lz -lbz2 -L/sw/lib -lusb -Wl,-framework,IOKit -Wl,-framework,CoreFoundation -Wl,-prebind Undefined symbols for architecture x86_64: _iconv, referenced from: _utf8_to_native in libutil.a(strgutil.o) _native_to_utf8 in libutil.a(strgutil.o) __nl_find_msg in libintl.a(dcigettext.o) _iconv_close, referenced from: _utf8_to_native in libutil.a(strgutil.o) _native_to_utf8 in libutil.a(strgutil.o) _set_native_charset in libutil.a(strgutil.o) _iconv_open, referenced from: _utf8_to_native in libutil.a(strgutil.o) _native_to_utf8 in libutil.a(strgutil.o) _set_native_charset in libutil.a(strgutil.o) __nl_find_msg in libintl.a(dcigettext.o) ld: symbol(s) not found for architecture x86_64 collect2: ld returned 1 exit status make[2]: *** [gpg] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: [Announce] [security fix] GnuPG 1.4.14 released
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Werner Koch wrote on 7/25/13 6:26 AM: Hello! We are pleased to announce the availability of a new stable GnuPG-1 release: Version 1.4.14. This is a *security fix* release and all users of GnuPG 2.0 are advised to updated to this version. See below for the impact of the problem. Hi, - From Terminal: Version info: gnupg 1.4.14 Configured for: Darwin (x86_64-apple-darwin12.4.0) gpg (GnuPG) 1.4.14 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Home: ~/.gnupg Supported algorithms: Pubkey: RSA, RSA-E, RSA-S, ELG-E, DSA Cipher: IDEA (S1), 3DES (S2), CAST5 (S3), BLOWFISH (S4), AES (S7), AES192 (S8), AES256 (S9), TWOFISH (S10), CAMELLIA128 (S11), CAMELLIA192 (S12), CAMELLIA256 (S13) Hash: MD5 (H1), SHA1 (H2), RIPEMD160 (H3), SHA256 (H8), SHA384 (H9), SHA512 (H10), SHA224 (H11) Compression: Uncompressed (Z0), ZIP (Z1), ZLIB (Z2), BZIP2 (Z3) Thank you. Charly 0x15E4F2EA Mac OS X 10.8.3 (12D78) MacBook Intel C2Duo 2GHz 13-inch, Aluminum, Late 2008 . GnuPG v2.0.19 (Darwin) - gpg (GnuPG) 1.4.14 TB 17.0.7 Enigmail version 1.5.1 (20130205-0013) -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.14 (Darwin) iQIcBAEBCgAGBQJR8X4BAAoJEPPf0YAV5PLqXycP/A8VsxYaukt5ZpRIJLyvLaBd bVvcLsxv5E9PgG9qQd9jfOTgMu9heGH+nmkiCgaYwzbf6zpI1QXNF8HOW8UtitrC wkS6JXwFC3oTP6foL74dmg2CwVknWr6blFD4ggfbSn4k3xLWiB93IOff7euhw1yd klt9/aQ4tXXLYlv6nZe+gVeEH7A2HAyGqeqzwZ89NxY9aX64/3GOJkuwx4Bnpnsy V8qXjbsYW5VJXuI5IQLPiLpF0wZNA1695FuKkqiObRBtL8n033iWJZr421iywj1x 9u8xxQgNqigiJAmj5pdaYhHzlGnYXcPBlLeN3PENi35Z5EKBlSBilZFY3cL2ERCm rBZXvkwmSmaLN4TNnZLu22MzE2N8NqCjqJkgXwNHF/+SmUqu8QCJht2R1Ih+wust 3lxuNXXI+Rqci11p/WbBl5nuTpqHdnJ3VITQzFDJ96HqN0dwQKoWKNgj0MTh+htn jElpidjwEBSMtVEWDa2pIxHo3dgVuB2u50furuQJm1dj7McwdUokB6MANrur7KjC iZoqnE60snHpN2bZRqkUjxq7DT4kANtBKpmVgxEzoh0xR6eKX1qbS23L35E9cL3V ClF8tnpHMGuxOQgmGNOLTMSdpxExFLrITiyOa7iYKbLiL9+RNrhaecYQjHLA4ux4 0JMQeSIOn2NRKA0/WkJc =FVTA -END PGP SIGNATURE- ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: [Announce] [security fix] GnuPG 1.4.14 released
Werner: No problems. MacBookPro9,1; Mountain Lion OS X 10.8.4 (12E55) Xcode 4.6.3 __outer On 2013-07-25 (206), at 06:26:55, Werner Koch w...@gnupg.org wrote: Hello! We are pleased to announce the availability of a new stable GnuPG-1 release: Version 1.4.14. This is a *security fix* release and all users of GnuPG 2.0 are advised to updated to this version. See below for the impact of the problem. ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
[Announce] [security fix] GnuPG 1.4.14 released
Hello! We are pleased to announce the availability of a new stable GnuPG-1 release: Version 1.4.14. This is a *security fix* release and all users of GnuPG 2.0 are advised to updated to this version. See below for the impact of the problem. For users of GnuPG = 2.0 a new version of Libgcrypt (1.5.3) has been released which fixes the problem for them. The GNU Privacy Guard (GnuPG) is GNU's tool for secure communication and data storage. It is a complete and free replacement of PGP and can be used to encrypt data and to create digital signatures. It includes an advanced key management facility, smartcard support and is compliant with the OpenPGP Internet standard as described by RFC-4880. Note that this version is from the GnuPG-1 series and thus smaller than those from the GnuPG-2 series, easier to build, and also better portable to ancient platforms. In contrast to GnuPG-2 (e.g version 2.0.20) it comes with no support for S/MIME, Secure Shell, or other tools useful for desktop environments. Fortunately you may install both versions alongside on the same system without any conflict. What's New === * Mitigate the Yarom/Falkner flush+reload side-channel attack on RSA secret keys. See http://eprint.iacr.org/2013/448. * Fixed IDEA for big-endian CPUs * Improved the diagnostics for failed keyserver lockups. * Minor bug and portability fixes. Impact of the Cache Side-Channel Attack === Here is the abstract from the Yarom and Falkner paper: Flush+Reload is a cache side-channel attack that monitors access to data in shared pages. In this paper we demonstrate how to use the attack to extract private encryption keys from GnuPG. The high resolution and low noise of the Flush+Reload attack enables a spy program to recover over 98% of the bits of the private key in a single decryption or signing round. Unlike previous attacks, the attack targets the last level L3 cache. Consequently, the spy program and the victim do not need to share the execution core of the CPU. The attack is not limited to a traditional OS and can be used in a virtualised environment, where it can attack programs executing in a different VM. I general the use of private keys on multi-user machines is imminent dangerous due to a variety of possibly attacks. Example for such attacks are locally exploitable vulnerabilities and all kind of side channel attacks which can't be mitigated by the operating system. Thus the best advise is to use a private key only on a fully trusted machine; i.e. a machine with full control over the software which may run on it. However, it is common to put private keys on servers for example to process encrypted mail. If the server hardware is shared with other users it is thus important to update GnuPG so to avoid the described attack. On a pure desktop machine, with only one user, mounting this attack is probably not effective because there are easier ways to gain access to the machine and thus the keys. For best protection of private keys, smartcards are often the best choice. Getting the Software First of all, decide whether you really need GnuPG version 1.4.x - most users are better off with the modern GnuPG 2.0.x version. Then follow the instructions found at http://www.gnupg.org/download/ or read on: GnuPG 1.4.14 may be downloaded from one of the GnuPG mirror sites or direct from ftp://ftp.gnupg.org/gcrypt/ . The list of mirrors can be found at http://www.gnupg.org/mirrors.html . Note, that GnuPG is not available at ftp.gnu.org. On the mirrors you should find the following files in the *gnupg* directory: gnupg-1.4.14.tar.bz2 (3601k) gnupg-1.4.14.tar.bz2.sig GnuPG source compressed using BZIP2 and OpenPGP signature. gnupg-1.4.14.tar.gz (4967k) gnupg-1.4.14.tar.gz.sig GnuPG source compressed using GZIP and OpenPGP signature. gnupg-1.4.13-1.4.14.diff.bz2 (14k) A patch file to upgrade a 1.4.13 GnuPG source tree. This patch does not include updates of the language files. Select one of them. To shorten the download time, you probably want to get the BZIP2 compressed file. Please try another mirror if exceptional your mirror is not yet up to date. In the *binary* directory, you should find these files: gnupg-w32cli-1.4.14.exe (1567k) gnupg-w32cli-1.4.14.exe.sig GnuPG compiled for Microsoft Windows and OpenPGP signature. This is a command line only version; the source files are the same as given above. Note, that this is a minimal installer and unless you are just in need for the gpg binary, you are better off using the full featured installer at http://www.gpg4win.org . Checking the Integrity == In order to check that the version of GnuPG which you are going to install is an original and unmodified one, you can do it in one of the following ways: * If you already have a
Re: [Announce] [security fix] GnuPG 1.4.14 released
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Werner Koch wrote on 7/25/13 6:26 AM: Hello! We are pleased to announce the availability of a new stable GnuPG-1 release: Version 1.4.14. This is a *security fix* release and all users of GnuPG 2.0 are advised to updated to this version. See below for the impact of the problem. Hi, - From Terminal: Version info: gnupg 1.4.14 Configured for: Darwin (x86_64-apple-darwin12.4.0) gpg (GnuPG) 1.4.14 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Home: ~/.gnupg Supported algorithms: Pubkey: RSA, RSA-E, RSA-S, ELG-E, DSA Cipher: IDEA (S1), 3DES (S2), CAST5 (S3), BLOWFISH (S4), AES (S7), AES192 (S8), AES256 (S9), TWOFISH (S10), CAMELLIA128 (S11), CAMELLIA192 (S12), CAMELLIA256 (S13) Hash: MD5 (H1), SHA1 (H2), RIPEMD160 (H3), SHA256 (H8), SHA384 (H9), SHA512 (H10), SHA224 (H11) Compression: Uncompressed (Z0), ZIP (Z1), ZLIB (Z2), BZIP2 (Z3) Thank you. Charly 0x15E4F2EA Mac OS X 10.8.3 (12D78) MacBook Intel C2Duo 2GHz 13-inch, Aluminum, Late 2008 . GnuPG v2.0.19 (Darwin) - gpg (GnuPG) 1.4.14 TB 17.0.7 Enigmail version 1.5.1 (20130205-0013) -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.14 (Darwin) iQIcBAEBCgAGBQJR8X6zAAoJEPPf0YAV5PLqPeQQAJHGfEXMUq5FloKmRn6HJk28 +Svxu2+4+LUhGOlbABwzieG0YdphKND4bpr88C5itC31LHcpDO/Z4RWh8MFM9Gdf kk6MTwQtJ07AE/mH2FdWe8o2WM4rvPUda7b2rQARwjrzTGU2DxZd5QLlX5mwyQr6 8gsKyNmuO6lakafJ+kv+t7nux5zdubVRvUQ8QEow80JA13fFt82dOy0Zub/qHblM mR/sVKHwdzT0jhhehs85yjOFBIGFUtDgELukf8o/6YaLb12yZXCPpBBoVOrnJ1WS U9VDxUXdeXEjuha/UvV6GSdeiO700dOkDJQohNdv6wq9YLpfT8rlBvBt1b7Dj0TT OBtj8h6z3yzAGlXtlJ+L2iPmr8bHn8SSjtX6gghnoft5Y2V8IQpb2plaJa5UCGRX 7h4AkbrSWYcQ0KBV5Yw57Ox/Gd6vTbNF40Y+vDCCtynV+TiEADGP01DRYm27+rOC cJVYXhsZpAj/W7oIqdiOYqWXhQGDWAKHX+Zgs2DOOJkb0QntB0QFIaaEN/1/eKIC 0r+r8qsAL2ZIMPOVaTkBWvAUQs38gOgst/JCVV9lB0W20+V4qFiScqgfoNPt7rOz IAGWKHF7KiIfOcKfb0v7NUw6IzXh7yD1XIPTj7UVpEG+TDj+soi1ku8UzWD1ax7N iQ5Xm5x5lqiQ7DmRbsSH =qpe3 -END PGP SIGNATURE- ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
