Bug 65862 (CVE-2005-0366)

... for the sake of completeness. 
 
Date: Thu, 10 Feb 2005 20:00:17 -0500 
From: David Shaw <dshaw@jabberwocky.com> 
To: announce@gnupg.org 
Message-ID: <20050211010017.GC1476@jabberwocky.com> 
Cc: 
Subject: [Announce] Attack against OpenPGP encryption 
 
Last night, Serge Mister and Robert Zuccherato published a paper 
reporting on an attack against OpenPGP symmetric encryption. 
 
This attack, while very significant from a cryptographic point of 
view, is not generally effective in the real world.  To be specific, 
unless you have your OpenPGP program set up as part of an automated 
system to accept encrypted messages, decrypt them, and then provide a 
response to the submitter, then this does not affect you at all. 
 
There is a very good writeup on the attack that goes into more depth 
at http://www.pgp.com/library/ctocorner/openpgp.html 
 
There will undoubtedly be further discussion of this over the next 
several days, but I wanted to provide a few comments now, to try and 
answer some questions that may arise: 
 
1) This is not a bug in any particular OpenPGP implementation (GnuPG, 
   PGP, Hushmail, etc).  Rather, this is an attack against the OpenPGP 
   protocol itself. 
 
2) The attack requires an average of 32,768 probes to get two bytes of 
   plaintext.  This is why it is completely ineffective against 
   human beings, who will presumably wonder why a stranger wants them 
   to decrypt thousands and thousands of messages that won't decrypt, 
   and then tell them what errors were seen. 
 
3) It might be effective against an automated process that 
   incorporates OpenPGP decryption, if that process returns errors 
   back to the sender. 
 
4) The OpenPGP Working Group will be discussing this issue and coming 
   up with an effective and permanent fix.  In the meantime, I have 
   attached two patches to this mail.  These patches disable a 
   portion of the OpenPGP protocol that the attack is exploiting. 
   This change should not be user visible.  With the patch in place, 
   this attack will not work using a public-key encrypted message.  It 
   will still work using a passphrase-encrypted message.  These 
   patches will be part of the 1.2.8 and 1.4.1 releases of GnuPG. 
 
5) The full paper is available at http://eprint.iacr.org/2005/033 
   It's a great piece of work. 
 
David 
 
Index: include/cipher.h