PGP and GnuPG defeated..

[chefer]

OpenPGP and GnuPG are susceptible to a chosen-cyphertext attack which would allow an adversary capable of intercepting an encrypted message to use the intended recipient as an unwitting 'decryption oracle', researchers Kahil Jallad, Jonathan Katz and Bruce Schneier report in a recent paper

This article really seemed kinda obvious to me, but I think the subject matter is worth reading about if you have at any point used either PGP or GnuPG.

The authors have confirmed that the attack can be exploited practically.

The fact that it can be practically exploited is a little bothersome. I don't use PGP and GPG for home use, but at work we tend to use it quite often over internet and intranet. I vaguely recall that there was a new revision (PGP) to be released this year and I hope that part of this will become a little less likely to occur.


My Source which seems to have gotten it's information from here.


For those interested, the paper describing this is available here.
I recommend reading the paper so you can be well informed and make good decisions on the direction you would like to continue on in as it pertains to your encryption measures.


Happy reading and regards.

[The Old Man]

Chefer, good info, thanks. this is about the second succesfull in a couple of esoteric methods of attack, but most of us would not be affected by either; this one was (i believe?) tested with PGP version 2-something and depended on the recipient reacting to a garbled message and sending a reply (to the attacker who was imitating the initiator...) asking for clarification. Most of us check the backside of email headers for important incoming, which would in all liklihood expose the faker's true address as not being from your compatriot. Additionally i believe that the basic structure has changed drastically between PGP v-2+ and the present PGP v7.2 (not counting NAI's subsequent iteration of course). Anyway, thanks, this is good to keep up with.