GnuPG 2.1.0 "modern" released [LWN.net]

GnuPG 2.1.0 "modern" released

Posted Nov 13, 2014 10:06 UTC (Thu) by dlang (guest, #313)
In reply to: GnuPG 2.1.0 "modern" released by dd9jn
Parent article: GnuPG 2.1.0 "modern" released

but even the pre-image attacks don't result in a document that looks like a reasonable e-mail, or other human readable document (even a computer interpreted binary needs a bunch of 'junk' thrown in to create a match)

So while it doesn't result in a mathematically 'guaranteed[*]' signature, something signed by an old key that looks reasonable still has a very high probability of being what was initially signed.

As for encryption, how does being able to generate a new document that has the same hash as the old one make it possible to see what was in the old document?

I agree with the earlier poster, it's worth preventing these old keys from being used to sign/encrypt new stuff, but it doesn't make sense to prevent them from being used to access existing data (or validate the signature of the old data)

As I said before, it's just not possible to re-sign every document that was created, and even for encryption, if the encrypted version of the document is in the hands of the bad guy, re-encrypting your copy of it will achieve absolutely nothing in terms of preventing the bad guy from decrypting it.

So no, those documents should not be thrown away and their signatures treated as being worthless.

to post comments

GnuPG 2.1.0 "modern" released

Posted Nov 13, 2014 11:20 UTC (Thu) by dd9jn (✭ supporter ✭, #4459) [Link]

Okay, okay,

what we see here is the usual problem of practical cryptography: We have to find some middle ground between those who use the software for every days purpose and the more paranoid geeks, known crypto gurus, and policy requirements. That is not easy and with my pragmatic user hat on I agree to your concerns. OTOH, I have to defend the use of such "insecure" practise from the complains of the latter group. See for example https://bugs.debian.org/739424 .

Instead of trying to fix flaws related to the use of PGP-2 keys, 2.1.0 simply kicks out all support and I feel now much safer not to keep on maintaining all these little workarounds for PGP-2.

To say it with Rick: We always have 1.4.

GnuPG 2.1.0 "modern" released

Posted Nov 13, 2014 16:55 UTC (Thu) by raven667 (subscriber, #5198) [Link] (1 responses)

> but even the pre-image attacks don't result in a document that looks like a reasonable e-mail, or other human readable document (even a computer interpreted binary needs a bunch of 'junk' thrown in to create a match)

While you would probably notice in an email it is demonstrated that you can create JPEGs with the same MD5 and it's not even hard anymore.

http://natmchugh.blogspot.co.uk/2014/10/how-i-created-two...

GnuPG 2.1.0 "modern" released

Posted Nov 13, 2014 19:54 UTC (Thu) by dlang (guest, #313) [Link]

so that means that when you can throw in a huge amount of essentially random data without the user noticing, then signatures involving md5 are not that useful

But if you limit the problem space to something that is human readable and makes sense (in a human or programming language without large blobs), then it becomes a MUCH harder problem.

And if you are trying to alter what someone said to make it seem like they actually said something else (as opposed to just vandalizing something, for which deleting the data is just as effective, and not protected by any encryption/signing), then you are even more contrained.

If you have signatures on code, then before any weakness in the hash is significant you need to be able to replace it with new code that will compile, and doesn't scream "something wrong" when a human looks at it.