Attack Against OpenPGP Encryption

An interesting post to the GnuPG Announce list by David Shaw

From: David Shaw
To: gnupg-announce at gnupg dot org

Last night, Serge Mister and Robert Zuccherato published a paper
reporting on an attack against OpenPGP symmetric encryption.

This attack, while very significant from a cryptographic point of
view, is not generally effective in the real world. To be specific,
unless you have your OpenPGP program set up as part of an automated
system to accept encrypted messages, decrypt them, and then provide a
response to the submitter, then this does not affect you at all.

There is a very good writeup on the attack that goes into more depth
at http://www.pgp.com/library/ctocorner/openpgp.html

There will undoubtedly be further discussion of this over the next
several days, but I wanted to provide a few comments now, to try and
answer some questions that may arise:

1) This is not a bug in any particular OpenPGP implementation (GnuPG,
PGP, Hushmail, etc). Rather, this is an attack against the OpenPGP
protocol itself.

2) The attack requires an average of 32,768 probes to get two bytes of
plaintext. This is why it is completely ineffective against
human beings, who will presumably wonder why a stranger wants them
to decrypt thousands and thousands of messages that won't decrypt,
and then tell them what errors were seen.

3) It might be effective against an automated process that
incorporates OpenPGP decryption, if that process returns errors
back to the sender.

4) The OpenPGP Working Group will be discussing this issue and coming
up with an effective and permanent fix. In the meantime, I have
attached two patches to this mail. These patches disable a
portion of the OpenPGP protocol that the attack is exploiting.
This change should not be user visible. With the patch in place,
this attack will not work using a public-key encrypted message. It
will still work using a passphrase-encrypted message. These
patches will be part of the 1.2.8 and 1.4.1 releases of GnuPG.

5) The full paper is available at http://eprint.iacr.org/2005/033
It's a great piece of work.

David