Re: possible new type of pgp plaintext attack ?

[[e-mail]]

No need to go through all the gyrations, since Bob's public key is public 
and known to her.  She can perform chosen plaintext attack on the key all 
she wants, with specialized tools and hardware.  No need to only use known 
session keys for whole messages encrypted by PGP; just run RSA or DSA 
yourself on any chosen material.

It is a fundimental requirement that a public key algorithm be able to 
withstand such an attack.  The existance of a "weak block" would imply 
that the function is not one-way after all.

--John







"vedaal" <[e-mail]>
Sent by: [e-mail]
08-20-2002 04:40 PM

 
        To:     <[e-mail]>
        cc: 
        Subject:        possible new type of pgp plaintext attack ?



atfer reading the paper on the pgp reply/plaintext attack,  was wondering 
if
there might be an additional way to mount a different type of plaintext
attack,
which is independent of the recipient's reply:

consider:

Alice pgp encrypts a message to Bob, and by default, simultaneously to
herself.

Alice can use gnupg to obtain the session key for the message, by
decrypting the default encrypted message to her own key.

The session key, can now be used as a known plaintext,
the packet of the session key encrypted to Bob's public key, is the
ciphertext,

and Bob's [ private key + passphrase hash ] the unknown, that is sought.


now,

if we assume that:
(a) Alice can use a watered-down implementation of pgp that does not use
'salt'

and

(b) Alice can intentionally use a flawed 'crackable' algorithm to encrypt 
to
Bob's key
{like using an 'experimental algo' in gnupg, but finding/making one that 
is
easily cracked, or trivial to begin with}

then,
is it possible for Alice to retrieve Bob's [private key + passphrase 
hash],
which could then be used to decrypt  other messages encrypted to Bob's key 
?


TIA,

vedaal