[14233] in bugtraq
Re: PGP Signatures security BUG!
daemon@ATHENA.MIT.EDU (Eric Murray)
Thu Mar 9 07:38:33 2000
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Message-Id: <20000308085045.02497@slack.lne.com>
Date: Wed, 8 Mar 2000 08:50:45 -0800
Reply-To: Eric Murray <ericm@LNE.COM>
From: Eric Murray <ericm@LNE.COM>
X-To: "Povl H. Pedersen" <pope@NETGUIDE.DK>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <p04310108b4eabe46523c@[130.227.158.132]>; from Povl H. Pedersen
on Tue, Mar 07, 2000 at 03:29:00PM +0100
On Tue, Mar 07, 2000 at 03:29:00PM +0100, Povl H. Pedersen wrote:
> THE PROBLEM
>
> The problem is, that the PGP servers expects all key IDs to be unique
> numbers, and does not expect 2 users to have the same keyID. And with
> the current amount of users, we are starting to get multiple users
> with the same keyID.
This problem has been known for a long time. It's called
the 'deadbeef attack'. It's discussed in the PGP FAQ:
(http://www.pgp.net/pgpnet/pgp-faq/faq-04.html)
"The key ID
It is possible to create a key with a chosen key ID. Paul Leyland
<pcl@sable.ox.ac.uk> explains:
A PGP key ID is just the bottom 64 bits of the public modulus (but
only the bottom 32 bits are displayed with pgp -kv). It is easy to
select two primes which when multiplied together have a specific
set of low-order bits.
This makes it possible to create a fake key with the same key ID as an
existing one. The fingerprint will still be different, though.
By the way, this attack is sometimes referred to as a DEADBEEF attack.
This term originates from an example key with key ID 0xDEADBEEF which
was created to demonstrate that this was possible. "
> EXPLOIT
>
> It is possible to generate false signatures, and John Smith can send
> new e-mails in the name of Mike Evans to users who does not have
> Mike Evans' key in their keyring, and when they do a lookup, they
> will find Mike Evans' key.
That's why you're not supposed to depend on the keyid alone
to authenticate PGP keys. See the FAQ.
> It will take a long time to generate a new key with a specific
> fingerprint, but nonetheless, this 'overwriting' and hiding of other
> users IDs in the public PGP servers is bad.
Yep. The deadbeef attack has been known for years, the servers
really should use all of the modulus as the database index and return
all matches on keyid.
--
Eric Murray www.lne.com/~ericm ericm at the site lne.com PGP keyid:E03F65E5
