LONG: PGP inventor says encryption flaw minor (fwd)
Owen Blacker
owen.blacker at wheel.co.uk
Thu, 22 Mar 2001 11:48:51 -0000
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> -----Original Message-----
> Sent: Thursday, March 22, 2001 12:01 AM
> To: mark-thomas@gbnet.net; mark-thomas@yahoogroups.com
> Subject: [mt] PGP inventor says encryption flaw minor - long
>
>
> On 21 Mar 01, at 23:58, Mario Profaca wrote:
> Flaw reported in popular e-mail encryption program
> http://www.siliconvalley.com/docs/news/tech/063453.htm
>
> Flaw Discovered In E-Mail Encryption
> http://www.sfgate.com/cgi-bin/article.cgi?file=/chronicle/archive/20
> 01/03/21/BU164685.DTL&type=business
>
> PGP inventor says encryption flaw minor
> http://news.cnet.com/news/0-1003-200-5208418.html?tag=mn_hd
>
> http://www.zdnet.com/zdnn/stories/news/0,4586,5079913,00.html
>
> ===============================
>
> Posted at 8:14 p.m. PST Tuesday, March 20, 2001
> Flaw reported in popular e-mail encryption program
> http://www.siliconvalley.com/docs/news/tech/063453.htm
>
> BY JAMES GLANZ
> New York Times
>
> Two cryptologists announced Tuesday that they had found a flaw in
> the most widely used program for sending encrypted, or coded,
> e-mail messages. If confirmed, the flaw would allow a determined
> adversary to obtain secret codes used by senders of encrypted
> e-mail.
>
> The program, called PGP for Pretty Good Privacy, is used by human
> rights organizations to protect vulnerable sources, by corporations
> to ensure secure communications and by millions of individual
> users. American security experts cautioned that they could not
> fully judge the accuracy of the claim, which was issued in Prague,
> before more technical details became available. The experts also
> noted that some sort of access to the sender's computer -- either
> directly or via the Internet -- would be needed to exploit any such
> flaw.
>
> Mark McArdle, vice president of PGP engineering at Network
> Associates in Santa Clara, which licenses the encryption program to
> corporate and individual users, said he had already assigned a team
> of engineers to check out the claim, which he learned of Tuesday
> from a journalist.
>
> ``We are very eager to both analyze this and respond to it,''
> McArdle said. ``We want to make sure that our systems are
> completely robust.''
>
> According to a statement issued Tuesday by ICZ, an information
> technology company in Prague with about 500 employees, the
> cryptologists, Vlastimil Klima and Tomas Rosa, found the problem
> while doing research on secure communications for the Czech
> government.
>
> ``It is very serious,'' said Kriz Zdenek, general manager of ICZ,
> who said a technical paper on the finding would be made available
> by Friday on the company's Web site (www.icz.cz).
>
> McArdle expressed surprise that the Czech company did not inform
> him of the problem so that a software fix, often called a patch,
> could be made available with the announcement of any bug. But
> Miroslav Votruba, marketing director at ICZ, said several e-mail
> messages informing Network Associates of the problem more than a
> week ago received no response.
>
> ``We are willing to cooperate before the algorithm or description
> of the problem will be released on the Web,'' Votruba said.
>
> PGP relies on a type of cryptography that uses two separate keys,
> one to encode a message and one to decode it. The flaw claimed by
> the cryptographers does not involve cracking the code itself, which
> is considered virtually invulnerable, but would work around it by
> allowing an intruder to steal one of the keys held privately by a
> user.
>
> Without such a flaw or bug, the private key would be unavailable
> even to an intruder who gained access to a computer, because it
> exists there only in scrambled form. The ICZ announcement says
> there is a way to unscramble it but gives few details. McArdle said
> such a bug would affect mainly the coded electronic ``signatures''
> that allow the recipient to verify the sender's identity. In
> effect, it would allow the intruder to impersonate the sender in
> future communications.
>
> ``This is probably real,'' said Bruce Schneier, founder and chief
> technology officer of Counterpane Internet Security in San Jose,
> referring to the bug. But he said it showed that e-mail security
> involved more than simply protecting the message in transit on the
> Internet.
>
> ===============================
>
> PGP inventor says encryption flaw minor
> http://news.cnet.com/news/0-1003-200-5208418.html?tag=mn_hd
>
> By Robert Lemos
> Special to CNET News.com
> March 21, 2001, 12:35 p.m. PT
>
> A flaw found by two Czech researchers in the popular OpenPGP
> digital signature standard is real but relatively minor, Phil
> Zimmermann, chairman of the open-source group, said Wednesday.
>
> "This is not a practical attack," he said. "Your adversary has to
> be able to modify your private key. That means they have to have
> access to your computer." Once an attacker has access, there are
> many other ways they can monitor the system. That makes the attack
> largely irrelevant, Zimmermann said.
>
> Two Czech researchers said Tuesday that they had found a hole in
> the widely used encryption and digital signature standard known as
> OpenPGP. They remained silent on the technical details, however,
> leaving many security experts wondering whether the flaw actually
> existed.
>
> The researchers, Vlastimil Klima and Tomas Rosa, posted a statement
> on the Web site of The ICZ Group, a Czech information technology
> company, but the two men have yet to release a technical report
> detailing the flaw.
>
> Klima and Rosa did not respond to e-mail messages sent by CNET
> News.com on Tuesday seeking comment.
>
> The OpenPGP standard is used in many programs -- including Network
> Associates' PGP and GNU Privacy Guard -- to allow messages to be
> encrypted or digitally signed to ensure the content hasn't been
> changed. It uses two codes, or "keys," to encrypt and decrypt
> messages: a public key that others know and a private key that
> should be kept secret.
>
> The flaw, according to the press release, allows an attacker to
> learn a person's private key by modifying the encrypted data and
> then capturing a message signed with the key. A simple program then
> reveals the key to the attacker. After that, the attacker can then
> use the code to sign new messages, essentially giving him or her
> the power to forge electronic documents.
>
> Neither Zimmermann, who created the original Pretty Good Privacy
> program in 1991, nor engineers at Network Associates, which
> currently owns the PGP trademark, were able to get more details
> from the researchers.
>
> The OpenPGP group, however, was able to reconstruct the attack from
> the details in the release and confirmed that it does exist.
>
> "We understand the attack," Zimmermann said. "They didn't talk to
> us about it. They are just kind of springing this at a trade show."
>
>
> Both Zimmermann and Network Associates criticized The ICZ Group for
> putting people's security at risk for what amounts to a publicity
> stunt.
>
> "This is not the way that we encourage researchers and vendors to
> keep up with security issues," said Mark McArdle, vice president of
> PGP engineering for Network Associates, adding that confirming or
> debunking the claims based on the information in the release is not
> possible.
>
> Even though the company has not confirmed the flaw, Network
> Associates is treating the issue seriously, McArdle said.
>
> "We take every single one of these issues very seriously," he said.
> "There is a rich history of excited individuals saying they broke
> PGP, but later it turns out that it is not true. However, we assume
> that it is an issue until we verify that it is not."
-----BEGIN PGP SIGNATURE-----
Version: PGP 7.0
Comment: Due to RIP, pls check for revocation before using this key!
iQA/AwUBOrnmf1VeQSYAA2h0EQIRJgCg9m3UsyTl4Q0z3CvO5fgaeQpqvs0AoMiP
WCVRmu64zzMAJhZRXJNx2hyk
=hzyV
-----END PGP SIGNATURE-----
_____________________________________________________________________
This message has been checked for all known viruses by UUNET delivered
through the MessageLabs Virus Control Centre. For further information visit
http://www.uk.uu.net/products/security/virus/