Hot answers tagged

12

From this answer: The difficulty of factoring (thus, as far as we know, the security of RSA in the absence of side-channel and padding attacks) grows smoothly with $n$. So, if factoring is the method of choice for breaking RSA, it doesn't seem like it really helps.


6

OpenPGP is a hybrid cryptosystem. The actual message is encrypted applying a symmetric cipher like AES with a random session key. This session key again is encrypted using a public/private key cryptography algorithm like RSA. This is mostly because symmetric encryption is much faster than public/private key cryptography, especially for large messages. As the ...


5

PGP key formats are defined in RFC 4880. Specifically, section 5.5. The private key format includes the public key and quite a bit of other information in unencrypted form. It might be easier to add another layer of encryption on top of that before you use steganography.


5

RFC 4880, OpenPGP (superseded RFC 2440 which was up to date in 2002) contains a chapter on security considerations, which also discusses the decryption oracle attack Jallad et al described: In late summer 2002, Jallad, Katz, and Schneier published an interesting attack on the OpenPGP protocol and some of its implementations [JKS02]. In ...


4

What they're doing is doing a fast test to see if a candidate prime prime+step has any of the smallest 669 primes as a factor (by testing whether prime%p + step is a multiple of the small prime p. If they do find that the candidate has a small factor, then it is obviously not prime (and so they don't need to spend the comparatively long time running the ...


4

man gpg... GnuPG may ask you to enter the passphrase for the key. This is required because the internal protection method of the secret key is different from the one specified by the OpenPGP protocol. I guess that answers it. Though if anybody knows more, feel free to share.


3

This is actually a rather interesting question, whiches solution is obvious to all cryptographers but I guess nobody cared yet to write it down. After all, our computers who are generating secret keys (not just GPG / RSA) are deterministic machines. These deterministic machines implement well-defined routines to generate keys of well-defined format which ...


3

Exchanging full RSA keys can be very inconvenient, as they consist of very long numbers. In the OpenPGP ASCII-armored version, my public key (without any user IDs and certifications!) already is very long stream: mQQNBFDaK/sBIADm2gjnw7aPoNIoCy7gj85btwZU+zGkvtGonznlLrXELdU6zR3u VHNCn9vAl6OoU32r+suFvGdX+7MjiPbGKwJFOvICpAVh6bV55+hdqJbS02cpPmJH 1BrrUAmm6ZVEybGd+...


3

The only possible answer to this is to check out the OpenPGP format and see if the message adheres to that format. You may need to build in some mechanisms to filter out tiny mistakes or extensions in the message though. As Open PGP is, well, open, there should be plenty libraries that perform this parsing for you. Library recommendations are off topic here ...


3

Sounds like a description of ECIES to me. ECIES is a hybrid cryptosystem that builds upon ECDH. Basically: the static public key of the receiver is used together with an ephemeral key pair generated at the sender. The public key of the receiver and ephemeral private key of the sender are used to generate a "shared secret" using ECDH. This shared secret is ...


3

TL;DR: There are different possibilities: A timestamp is included before compression, and can result in slightly different compressed message lengths. The encrypted session key is stored as multi-precision integers, which are of dynamic length. Finally, ASCII-armoring adds a padding that might enlarge the size difference slightly. Compression and Timestamps ...


3

This is a really hard question to answer. The definitive answer can only be found in the source code of gpg. However I can still answer your question using a mail I found (from 2013, details may have changed). Is 2 "better" (i.e. more random) than 0? Yes, 2 is "better" than 0 and 1. As per the linked mail the quality level determines the number of ...


2

I'm assuming that you mean any time the file changes, it is re-encrypted with PGP. Here is a description of how PGP encryption works: Whenever you change the file and re-encrypt with PGP, a new, independent session key is chosen. So what you end up with is a (potentially only slightly) modified file, being encrypted with a brand new session key. All ...


2

Pub alg - Reserved for Elliptic Curve(pub 18) unknown(pub 18) The output explains pgpdump knows this is an elliptic curve algorithm (which has ID 18), but does not understand the exact details (which curve was used, ...). Try gpg --list-packets instead which has full support for ECC (requires GnuPG 2.1, binary might also be called gpg2 on Debian and ...


2

As for the first reason: in the future you probably need the decompressed form of the message. There won't be much you can do with the compressed message. But PGP is application level; you may want to verify that message at any time. Now you may want to verify the signature over that decompressed data without compressing it first. E.g. it's a good use case ...


2

No, the master private key cannot decrypt anything encrypted by a subordinate public key. Otherwise, it would mean that the master keypair is the same as the subordinate keypair.


2

Your fingerprint is for OpenPGP V4 compatible as it uses SHA-1. The fingerprint is 20 bytes instead of 16 for MD5 used in the older package format. For V4 it is required to extract the public key packet first. This is likely to be the most tricky part, as PGP uses it's own packet format. You'll have to parse the binary data within your base 64 encoded blob ...


2

You say DER, but you tag PGP which doesn't use DER -- and whose publickey block includes a lot of things beyond the RSA values (n,e). The DER encoding of a PKCS#1 RSA publickey of 4096 bits with a conventional e of 65537 (default at least for openssl and Java) is 30 82 02 0a 02 82 02 01 (n with leading 00) 02 03 01 00 01 with a total length of 526 ...


2

The OpenPGP message you posted is a signature, not a key. As it was issued by GnuPG, I assume you're using GnuPG anyway. To export your public key, run gpg --armor --export [key-id]. --armor wraps the output in a base64-like encoding (like the signature block you provided in your question), otherwise you'll get binary output. If you don't know your key-id, ...


2

I would not consider your case to be a cascading encryption. The reason why is the fact you need multiple interventions before getting access to your file. Here is what I would consider a cascading encryption (let's go crazy) : $$E(k_1,k_2,k_3,m) = \text{KEYAK}(k_1,\text{NORX}(k_2,\text{AES}(k_3,m)))$$ which you would decipher with : $$E^{-1}(k_1,k_2,k_3,m)...


2

Yes, PGP allows different-sized subkeys and subkeys are not derived of the main key, so it is possible to have the earlier key be a subkey of the new one. How to do it is off topic here, but this should get you started if you use GnuPG.


1

As fgrieu noted in his answer using sign-then-encrypt is probably the best way of handling encrypted & signed messages. However when the OpenPGP format in RFC 4880 is studied it seems that it uses both PKCS#1 v1.5 padding and CBC mode encryption. Both schemes are vulnerable to padding oracle attacks. So it is important to make sure the software is not ...


1

Yes, PGP's sketch as in the question is sound by today's textbooks on cryptography, and reasonable from a computer security standpoint. Applying digital signature then encryption (critically: including on the signature) does provide data integrity and confidentiality for the message. PGP's way of doing things has the characteristic that one able to decipher ...


1

The padding used for RSA is not the PKCS #5/#7 padding (as you seem to suggest in your own answer), but the Wikipedia entry seems to refer to PKCS #1 v1.5 (RFC2313)) which uses a padding 00 || BT || PS || 00 || D where for RSA encryption we start with a 0x00-byte (to guarantee that the resulting number is below the modulus), then use BT (Block Type) equal ...


1

TL;DR: This attack extends the standard chosen ciphertext attacks on RSA and ElGamal to the hybrid encryption setting, but requires some huge IFs which no longer even have a slight possibility of being fulfilled. To understand this attack, one first needs to understand how data is encrypted for PGP according to this snippet. Let's assume you have a ...


1

Keeping a complete history of messages/keys Perfect forward secrecy is great to protect "stream kind" of messages, but that does not really fit what OpenPGP is (mostly) used for. Often, OpenPGP messages are sent and read from different machines, at different times, in different order. While OTR (offering perfect forward secrecy) does not rely on external ...


1

How does one verify a key revocation? As Jon Callas already stated: you simply don’t. In case a different wording helps, here’s a quote related to the exact same question… https://lists.gnupg.org/pipermail/gnupg-users/2014-February/049100.html … On 02/19/2014 11:55 AM, Hauke Laging wrote: Am Di 18.02.2014, 23:19:33 schrieb Tadas ...



Only top voted, non community-wiki answers of a minimum length are eligible