Implementation of Chosen-Ciphertext Attacks against PGP and GnuPG

[aleph1 at securityfocus.com]

Implementation of Chosen-Ciphertext Attacks against PGP and GnuPG
K. Jallad, J. Katz, and B. Schneier

We recently noted that PGP and other e-mail encryption protocols are, in 
theory, highly vulnerable to chosen-ciphertext attacks in which the recipient 
of the e-mail acts as an unwitting "decryption oracle." We argued further 
that such attacks are quite feasible and therefore represent a serious 
concern. Here, we investigate these claims in more detail by attempting to 
implement the suggested attacks. On one hand, we are able to successfully 
implement the described attacks against PGP and GnuPG (two widely-used 
software packages) in a number of different settings. On the other hand, we 
show that the attacks largely fail when data is compressed before encryption.

Interestingly,the attacks are unsuccessful for largely fortuitous reasons; 
resistance to these attacks does not seem due to any conscious effort made to 
prevent them. Based on our work, we discuss those instances in which 
chosen-ciphertext attacks do indeed represent an important threat and hence 
must be taken into account in order to maintain confidentiality. We also 
recommend changes in the OpenPGP standard to reduce the effectiveness of our 
attacks in these settings. 

http://www.counterpane.com/pgp-attack.pdf
http://www.counterpane.com/pgp-attack.ps.zip

-- 
Elias Levy
Symantec
Alea jacta est

----- End forwarded message -----