Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
PGP Allows Use of Unauthorized Additional Decryption Keys
An attacker could insert ADKs into the unsigned portion of the public key data structure where the attacker could then decrypt data.
ITPro Today
August 24, 2000
1 Min Read
Reported August 23, 2000 by Ralf Senderek
VERSIONS AFFECTED
Pretty Good Privacy (PGP) 5.5.3i for Windows
Pretty Good Privacy (PGP) 6.5.1i for Windows
DESCRIPTION
A flaw exists in the Addition Decryption Keys (ADK) key recovery mechanisms of PGP. An attacker could insert additional decryption keys into the unsigned portion of the public key data structure, which would systematically cause any encrypted to become decryptable by anyone with knowledge of the added decryption key.
BACKGROUND INFORMATION
Ralf Sederek's paper "How PGP Deals with Manipulated Keys"
"The Risks Of 'Key Recovery,' 'Key Escrow,' And 'Trusted Third-Party' Encryption" by Hal Abelson, Ross Anderson, Steven M. Bellovin, Josh Benaloh, Matt Blaze, Whitfield Diffie, John Gilmore, Peter G. Neumann, Ronald L. Rivest, Jeffrey I. Schiller, and Bruce Schneier.
Series of technical responses mirrored at Cryptome.
VENDOR RESPONSE
Network Associates is aware of the problem, however no response was known at the time of this writing.
CREDIT
Discovered by Ralf Senderek
About the Author(s)
You May Also Like
.jpg?width=700&auto=webp&quality=80&disable=upscale)
.jpg?width=700&auto=webp&quality=80&disable=upscale)
