[117355] in Cypherpunks
RE: PGP security hole ?
daemon@ATHENA.MIT.EDU (Lucky Green)
Wed Sep 1 02:34:10 1999
From: "Lucky Green" <shamrock@cypherpunks.to>
To: "SEMYAZA" <vecna@iquebec.com>, <cypherpunks@toad.com>
Date: Tue, 31 Aug 1999 23:18:27 -0700
Message-ID: <NDBBIFGOKODBCKDGJDKLMEPKCEAA.shamrock@cypherpunks.to>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0004_01BEF407.213C4920"
In-Reply-To: <00d401bef437$cebb1ba0$1600a8c0@pacific.net.ph>
Reply-To: "Lucky Green" <shamrock@cypherpunks.to>
This is a multi-part message in MIME format.
------=_NextPart_000_0004_01BEF407.213C4920
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Absolutely. In fact, my PGPKRAQ program was able to determine not just the
session key, but also your private key from the subliminal channel exposed
by your signature. Not only that, but your .sig also contained the last
URL's you visited. Hmm, you are interested in *what*? That's pretty sick...
--Lucky, who can't help but notice that these kind of questions are almost
always posted to cypherpunks@toad.com.
--Lucky Green <shamrock@cypherpunks.to>
-----Original Message-----
From: owner-cypherpunks@Algebra.COM
[mailto:owner-cypherpunks@Algebra.COM]On Behalf Of SEMYAZA
Sent: Tuesday, August 31, 1999 22:07
To: cypherpunks@toad.com
Subject: PGP security hole ?
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
It is true that PGP 6.5.1 leaks random session key bits in the SHA
signature? Big Brother inside?
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.1 for non-commercial use <http://www.pgp.com>
iQA/AwUBN8xD5cZ4RS2SUi9OEQISQgCeLpSHG9tx7QLVnhGZsolWXx2fONkAoJJH
aNiYH2bL+Hh3auukO4ChJwhn
=tU0f
-----END PGP SIGNATURE-----
------=_NextPart_000_0004_01BEF407.213C4920
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content=3D"text/html; charset=3Diso-8859-1" =
http-equiv=3DContent-Type>
<META content=3D"MSHTML 5.00.2314.1000" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT color=3D#0000ff face=3DArial size=3D2><SPAN=20
class=3D940441306-01091999>Absolutely. In fact, my PGPKRAQ program was =
able to=20
determine not just the session key, but also your private key from the=20
subliminal channel exposed by your signature. Not only that, but your =
.sig also=20
contained the last URL's you visited. Hmm, you are interested in *what*? =
That's=20
pretty sick...</SPAN></FONT></DIV>
<DIV><FONT color=3D#0000ff face=3DArial size=3D2><SPAN=20
class=3D940441306-01091999></SPAN></FONT> </DIV>
<DIV><FONT color=3D#0000ff face=3DArial size=3D2><SPAN=20
class=3D940441306-01091999>--Lucky, who can't help but notice that these =
kind of=20
questions are almost always posted to <A=20
href=3D"mailto:cypherpunks@toad.com">cypherpunks@toad.com</A>.</SPAN></FO=
NT></DIV>
<P><FONT size=3D2>--Lucky Green <shamrock@cypherpunks.to></FONT> =
</P>
<BLOCKQUOTE=20
style=3D"BORDER-LEFT: #0000ff 2px solid; MARGIN-LEFT: 5px; MARGIN-RIGHT: =
0px; PADDING-LEFT: 5px">
<DIV align=3Dleft class=3DOutlookMessageHeader dir=3Dltr><FONT =
face=3DTahoma=20
size=3D2>-----Original Message-----<BR><B>From:</B>=20
owner-cypherpunks@Algebra.COM =
[mailto:owner-cypherpunks@Algebra.COM]<B>On=20
Behalf Of </B>SEMYAZA<BR><B>Sent:</B> Tuesday, August 31, 1999=20
22:07<BR><B>To:</B> cypherpunks@toad.com<BR><B>Subject:</B> PGP =
security hole=20
?<BR><BR></DIV></FONT>
<DIV>-----BEGIN PGP SIGNED MESSAGE-----<BR>Hash: SHA1</DIV>
<DIV> </DIV>
<DIV><BR>It is true that PGP 6.5.1 leaks random session key bits in =
the=20
SHA<BR>signature? Big Brother inside?</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>-----BEGIN PGP SIGNATURE-----<BR>Version: PGPfreeware 6.5.1 for=20
non-commercial use <<A=20
href=3D"http://www.pgp.com">http://www.pgp.com</A>></DIV>
<DIV> </DIV>
=
<DIV>iQA/AwUBN8xD5cZ4RS2SUi9OEQISQgCeLpSHG9tx7QLVnhGZsolWXx2fONkAoJJH<BR>=
aNiYH2bL+Hh3auukO4ChJwhn<BR>=3DtU0f<BR>-----END=20
PGP SIGNATURE-----<BR></DIV></BLOCKQUOTE></BODY></HTML>
------=_NextPart_000_0004_01BEF407.213C4920--
