Slashdot Mirror
GnuPG's ElGamal Signing Keys Compromised
KjetilK writes "Werner Koch just sent an announcement saying that there is a severe bug in GnuPG >= 1.0.2 that makes it easy to compromise ElGamal keys used for signing. Note that such keys are not generated by GnuPG's standard setup, and should be relatively rare. Among the 850 public keys in my personal keyring, there were only one such public key (and a few subkeys). There is already a patch available to disable these keys."
Fortunately, Werner Koch informed me yesterday already (I got the email at some time in the morning), so I had plenty of time to create a new key, sign it with the old one, and revoke the old one.
:-/
Of course, this had one disadvantage: since the old key is potentially compromised, I cannot really trust in my web of trust anymore.
A monkey is doing the real work for me.
Wrong. This has nothing to do with complexity, but with choise. It is good that there are alternatives to choose from. If there is only one option, one bug will affect everything and everybody. So having a choise is good.
It would have been increased complexity when all options have dependencies. One failure would be more probable and bring the whole system down.
To answer your question: it's nice to have a choise. Now there is redundancy in the system.
And yes, we would all have picked on MS. That is just because they are disliked. That's mainly because of their business practices, but also 'cause working with their stuff is always annoying.
Actually thats Gammal .. Gamal means nothing in Swedish... Debil on the other hand... or Dumbom, analfabet, olbidad... Yea those..
MoFscker
Fuck the system? Nah, you might catch something.
"Gamal" is translated in Hebrew as "Camel". Wonder what that means... Perl ref?
So instead of choosing a product that was all out in the open, and where he could have audited the code for himself, your boss went for a closed-source product where he wasn't allowed to open it up and check how it worked and furthermore couldn't be sure there wasn't already a serious security vulnerability put there by Microsoft.
..... there is just no way to keep them secret. They appear, they get fixed, it is really not a big deal. Closed-source software can harbour vulnerabilities for a long time before anybody has reason to sort them out. If only a few people are suffering, it's easy for a large corporation like Microsoft to weasel out of fixing a "minor" problem ..... at least, until it gets to the point where they can no longer blame the customer anymore .....
Hiding your source code does nothing to help your security. If a programme is written securely, you can publish the source code and nobody will be able to crack it. If a programme is not written securely in the first place, the source code might make it a little easier to crack; but the chance that someone will crack it "accidentally" is independent of whether or not they have seen the source code. And published source code is subject to continuous audit. Which is precisely why we see vulnerabilities in open-source software
Your boss seriously needs to learn about the disinfectant power of daylight. Either that, or you're a troll. Considering that installing and configuring Apache consists of typing apt-get install apache in a root xterm, I suspect the latter.
Je fume. Tu fumes. Nous fûmes!
It's called goop off
I've used it before and can attest to it eating a hole through carpet right to the concrete.
Good attempt at being clever, but seeing as GnuPG is open source, backward enginnering isn't nessasary. You can't get in trouble under the DCMA for finding holes in open source software I'm afraid..
The DMCA specifically allows reverse-engineering in order to create a compatible product, but people have been sued for that (DeCSS). Best Buy and others sent used the DMCA against material that isn't even copyrightable (a list of prices).
So it's not that far out to suggest someone could be sued for finding a hole in open-source software. And they'd have to spend a lot of money to prove their innocence, even if it was a bogus lawsuit.
The DMCA has penalties for breaking encryption used as an effective access-control mechanism for copyrighted material - reverse-engineering isn't required. Since the ElGamal signature key can also be used for encryption, and pretty much everything you type is copyrighted, you could argue that the DMCA applies.
Ask, for instance, Dan Geer, an expert on software security and a top executive of @Stake, a security consulting firm. In September, he led a group that wrote a report blaming Microsoft's virtual "monoculture" in operating systems for the internet's frailty. No sooner was the report published than he found himself out of a job. @Stake, which counts Microsoft among its customers, "fired me by press release, retroactively and in public," he says.
The gist of Mr Geer's argument is that Microsoft has over the years created "unacceptable levels of complexity" in its computer code. It has done so because its main objective has been to lock users into its software by tying the Windows operating system together with applications such as Word, Explorer and Outlook. Complexity is "the enemy of security", says Mr Geer's report, since "the defender has to counter all possible attacks; the attacker only has to find one unblocked means of attack." Moreover, complexity feeds on itself since "fixing a known flaw is likely to introduce a new, unknown flaw."
"One of the symptoms of an approaching nervous breakdown is the belief that ones work is terribly important." -BRussell