2.x (was: [Announce] [security fix] GnuPG 1.4.16 released)
Werner == Werner Koch w...@gnupg.org writes: Hello! Along with the publication of an interesting new side channel attack by Daniel Genkin, Adi Shamir, and Eran Tromer we announce the availability of a new stable GnuPG release to relieve this bug: Version 1.4.16. This is a *security fix* release and all users of GnuPG versions 1.x are advised to updated to this version. GnuPG versions 2.x are not affected. See below for the impact of the problem. I am on Kubuntu 10.04 and I have both gnupg and gnupg2 installed. Now since 2.x is not affected by the problem mentioned I prefer to use it. However how can I be sure that gnupg2 is used for my email correspondence for which I use pgp-mime and not gnupg? (I am using Xemacs+gnus) thanks Uwe Brauer smime.p7s Description: S/MIME cryptographic signature ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
[Announce] [security fix] GnuPG 1.4.16 released
Hello! Along with the publication of an interesting new side channel attack by Daniel Genkin, Adi Shamir, and Eran Tromer we announce the availability of a new stable GnuPG release to relieve this bug: Version 1.4.16. This is a *security fix* release and all users of GnuPG versions 1.x are advised to updated to this version. GnuPG versions 2.x are not affected. See below for the impact of the problem. The GNU Privacy Guard (GnuPG) is GNU's tool for secure communication and data storage. It is a complete and free replacement of PGP and can be used to encrypt data and to create digital signatures. It includes an advanced key management facility, smartcard support and is compliant with the OpenPGP Internet standard as described by RFC-4880. Note that this version is from the GnuPG-1 series and thus smaller than those from the GnuPG-2 series, easier to build, and also better portable to ancient platforms. In contrast to GnuPG-2 (e.g version 2.0.22) it comes with no support for S/MIME, Secure Shell, or other tools useful for desktop environments. Fortunately you may install both versions alongside on the same system without any conflict. What's New === * Fixed the RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis attack as described by Genkin, Shamir, and Tromer. See http://www.cs.tau.ac.il/~tromer/acoustic/. [CVE-2013-4576] * Put only the major version number by default into armored output. * Do not create a trustdb file if --trust-model=always is used. * Print the keyid for key packets with --list-packets. * Changed modular exponentiation algorithm to recover from a small performance loss due to a change in 1.4.14. Impact of the security problem == CVE-2013-4576 has been assigned to this security bug. The paper describes two attacks. The first attack allows to distinguish keys: An attacker is able to notice which key is currently used for decryption. This is in general not a problem but may be used to reveal the information that a message, encrypted to a commonly not used key, has been received by the targeted machine. We do not have a software solution to mitigate this attack. The second attack is more serious. It is an adaptive chosen ciphertext attack to reveal the private key. A possible scenario is that the attacker places a sensor (for example a standard smartphone) in the vicinity of the targeted machine. That machine is assumed to do unattended RSA decryption of received mails, for example by using a mail client which speeds up browsing by opportunistically decrypting mails expected to be read soon. While listening to the acoustic emanations of the targeted machine, the smartphone will send new encrypted messages to that machine and re-construct the private key bit by bit. A 4096 bit RSA key used on a laptop can be revealed within an hour. GnuPG 1.4.16 avoids this attack by employing RSA blinding during decryption. GnuPG 2.x and current Gpg4win versions make use of Libgcrypt which employs RSA blinding anyway and are thus not vulnerable. For the highly interesting research on acoustic cryptanalysis and the details of the attack see http://www.cs.tau.ac.il/~tromer/acoustic/ . Getting the Software First of all, decide whether you really need GnuPG version 1.4.x - most users are better off with the modern GnuPG 2.0.x version. Then follow the instructions found at http://www.gnupg.org/download/ or read on: GnuPG 1.4.16 may be downloaded from one of the GnuPG mirror sites or direct from ftp://ftp.gnupg.org/gcrypt/ . The list of mirrors can be found at http://www.gnupg.org/mirrors.html . Note, that GnuPG is not available at ftp.gnu.org. On the mirrors you should find the following files in the *gnupg* directory: gnupg-1.4.16.tar.bz2 (3571k) gnupg-1.4.16.tar.bz2.sig GnuPG source compressed using BZIP2 and OpenPGP signature. gnupg-1.4.16.tar.gz (4955k) gnupg-1.4.16.tar.gz.sig GnuPG source compressed using GZIP and OpenPGP signature. gnupg-1.4.15-1.4.15.diff.bz2 (26k) A patch file to upgrade a 1.4.15 GnuPG source tree. This patch does not include updates of the language files. Select one of them. To shorten the download time, you probably want to get the BZIP2 compressed file. Please try another mirror if exceptional your mirror is not yet up to date. In the *binary* directory, you should find these files: gnupg-w32cli-1.4.16.exe (1573k) gnupg-w32cli-1.4.16.exe.sig GnuPG compiled for Microsoft Windows and its OpenPGP signature. This is a command line only version; the source files are the same as given above. Note, that this is a minimal installer and unless you are just in need for the gpg binary, you are better off using the full featured installer at http://www.gpg4win.org . Gpg4win uses GnuPG 2.x and is thus not affected by the security bug. Checking the Integrity == In order
Re: [Announce] [security fix] GnuPG 1.4.16 released // workaround
On Wednesday, December 18, 2013 at 9:25 AM, Werner Koch w...@gnupg.org wrote: The paper describes two attacks. The first attack allows to distinguish keys: An attacker is able to notice which key is currently used for decryption. ... While listening to the acoustic emanations of the targeted machine, the smartphone will send new encrypted messages to that machine and re-construct the private key bit by bit. A 4096 bit RSA key used on a laptop can be revealed within an hour. GnuPG 1.4.16 avoids this attack by employing RSA blinding during decryption. = Am not familiar with how RSA 'blinding' works, but am surprised that it cannot be used to 'blind' RSA as to the identity of the key ;-( Here is a potential workaround though: If a sender suspects that the receiver may be in a place where acoustical surveillance can detect the key id, then the sender and receiver can do the following: [1] The sender sends a message encrypted to both the sender's and receiver's usual keys, with an instruction in the plaintext, that if a 'special atypical' key is to be used, then the message is to be sent encrypted to that special atypical key, using the throw-keyid option, as well as encrypting conventionally to a passphrase. [2] The passphrase to be used for conventional encryption is the session key string for the first encrypted message in [1], which the sender and receiver now have, and they can decrypt the messages using conventional encryption. [3] Whenever the correspondents are in an environment 'safe' from this type of acoustic threat, the message can be decrypted using the 'special typical' key. Whatever information is intended to be conveyed by using a 'special key', will still be understood by the receiver. vedaal ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: [Announce] [security fix] GnuPG 1.4.16 released
Werner Koch wrote on 12/18/13, 4:05 PM: Hello! Along with the publication of an interesting new side channel attack by Daniel Genkin, Adi Shamir, and Eran Tromer we announce the availability of a new stable GnuPG release to relieve this bug: Version 1.4.16. This is a *security fix* release and all users of GnuPG versions 1.x are advised to updated to this version. GnuPG versions 2.x are not affected. See below for the impact of the problem. [...] Hi, compiled from source: Version info: gnupg 1.4.16 Configured for: Darwin (x86_64-apple-darwin13.0.0) gpg (GnuPG) 1.4.16 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Home: ~/.gnupg Supported algorithms: Pubkey: RSA, RSA-E, RSA-S, ELG-E, DSA Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256 Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224 Compression: Uncompressed, ZIP, ZLIB, BZIP2 Thank you for your work. Charly 0x15E4F2EA Mac OS X 10.9.1 (13B42) MacBook Intel C2Duo 2GHz 13-inch, Aluminum, Late 2008 . (GnuPG/MacGPG2) 2.0.22 - gpg (GnuPG) 1.4.16 TB 24.2.0 Enigmail version 1.6 (20131006-1849) ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
