mailing list archives
Re: PGP Signatures security BUG!
From: ericm () LNE COM (Eric Murray)
Date: Wed, 8 Mar 2000 08:50:45 -0800
On Tue, Mar 07, 2000 at 03:29:00PM +0100, Povl H. Pedersen wrote:
The problem is, that the PGP servers expects all key IDs to be unique
numbers, and does not expect 2 users to have the same keyID. And with
the current amount of users, we are starting to get multiple users
with the same keyID.
This problem has been known for a long time. It's called
the 'deadbeef attack'. It's discussed in the PGP FAQ:
"The key ID
It is possible to create a key with a chosen key ID. Paul Leyland
<pcl () sable ox ac uk> explains:
A PGP key ID is just the bottom 64 bits of the public modulus (but
only the bottom 32 bits are displayed with pgp -kv). It is easy to
select two primes which when multiplied together have a specific
set of low-order bits.
This makes it possible to create a fake key with the same key ID as an
existing one. The fingerprint will still be different, though.
By the way, this attack is sometimes referred to as a DEADBEEF attack.
This term originates from an example key with key ID 0xDEADBEEF which
was created to demonstrate that this was possible. "
It is possible to generate false signatures, and John Smith can send
new e-mails in the name of Mike Evans to users who does not have
Mike Evans' key in their keyring, and when they do a lookup, they
will find Mike Evans' key.
That's why you're not supposed to depend on the keyid alone
to authenticate PGP keys. See the FAQ.
It will take a long time to generate a new key with a specific
fingerprint, but nonetheless, this 'overwriting' and hiding of other
users IDs in the public PGP servers is bad.
Yep. The deadbeef attack has been known for years, the servers
really should use all of the modulus as the database index and return
all matches on keyid.
Eric Murray www.lne.com/~ericm ericm at the site lne.com PGP keyid:E03F65E5