Re: [Sheflug] SUID bit - how do I set it?

["Chris J/#6" <nospam [at] nccnet.co.uk>]

> 
> Not necessarily wise.  It depends (among other things) on the number
> of eyes; PGP is probably still an order of magnitude more popular than
> GPG.  Also, it's often true that these security holes work in somewhat
> mutated form on related software, but the related software's
> developers just say "glad that wasn't in MY backyard."

More popular means more users at risk :) The security hole in question is 
down to the "feature" of "Additional Decrpytion Keys" (ADK's) that you can 
add to an encrpytion key. Gnupg doesn't implement ADK's so isn't at risk. 
ADK's are also not part of RFC 2440 (which is what Gnupg implements).

To quote the problem:

	"Since NAI joined the Key Recovery Alliance, PGP has supported
	"Additional Decryption Keys" which can be added to a public 
	key.  The sender will then encrypt the session key to these as
	well as to your	main public key. The bug is that some versions 
	of PGP respond to ADK subpackets in the non-signed part of the 
	public key data structure. The effect is that GCHQ can create 
	a tampered version of your PGP public key containing a public 
	key whose corresponding private key is also known to themselves, 
	and circulate it. People who encrypt traffic to you will 
	encrypt it to them too."

The devil is in the implementation of the feature, which has meant that PGP 5 
& 6 suffer this problem. Gnupg has received a lot of attention and is 
considered to be reliable. If you're really that paranoid though, you'd audit 
the software yourself :)

One point to remember: changing your version of PGP won't solve the problem 
when you're receiving encrypted mail as it is the /sender's/ PGP that is at 
fault.

Chris...


-- 
@}-,'--------------------------------------------------  Chris Johnson --'-{ [at] 
    / "(it is) crucial that we learn the difference / sixie [at] nccnet.co.uk  \
   / between Sex and Gender. Therein lies the key  /                       \ 
  / to our freedom" -- LB                         / www.nccnet.co.uk/~sixie \ 


---------------------------------------------------------------------
Sheffield Linux User's Group - http://www.sheflug.co.uk
To unsubscribe from this list send mail to
- <sheflug-request [at] vuw.ac.nz> - with the word 
 "unsubscribe" in the body of the message. 

  GNU the choice of a complete generation.