Re: possible new type of pgp plaintext attack ? Wed, 21 August 2002 14:47 UTC

Received: from ( []) by (8.9.1a/8.9.1a) with ESMTP id KAA11813 for <>; Wed, 21 Aug 2002 10:47:37 -0400 (EDT)
Received: from localhost (localhost [[UNIX: localhost]]) by (8.11.6/8.11.3) id g7LEc2L16048 for ietf-openpgp-bks; Wed, 21 Aug 2002 07:38:02 -0700 (PDT)
Received: from ( []) by (8.11.6/8.11.3) with ESMTP id g7LEc0216037; Wed, 21 Aug 2002 07:38:01 -0700 (PDT)
Received: from ( []) by (8.11.1/8.11.1) with ESMTP id g7LEcTQ13615; Wed, 21 Aug 2002 10:38:29 -0400 (EDT)
Subject: Re: possible new type of pgp plaintext attack ?
X-Mailer: Lotus Notes Release 5.0.5 September 22, 2000
Message-ID: <>
Date: Wed, 21 Aug 2002 09:37:52 -0500
X-MIMETrack: Serialize by Router on KNOTES2/ISBP/EKC(Release 5.0.10 |March 22, 2002) at 08/21/2002 10:37:50 AM, Serialize complete at 08/21/2002 10:37:50 AM
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="=_alternative 00505F1086256C1C_="
Precedence: bulk
List-Archive: <>
List-Unsubscribe: <>
List-ID: <>

No need to go through all the gyrations, since Bob's public key is public 
and known to her.  She can perform chosen plaintext attack on the key all 
she wants, with specialized tools and hardware.  No need to only use known 
session keys for whole messages encrypted by PGP; just run RSA or DSA 
yourself on any chosen material.

It is a fundimental requirement that a public key algorithm be able to 
withstand such an attack.  The existance of a "weak block" would imply 
that the function is not one-way after all.


"vedaal" <>
Sent by:
08-20-2002 04:40 PM

        To:     <>
        Subject:        possible new type of pgp plaintext attack ?

atfer reading the paper on the pgp reply/plaintext attack,  was wondering 
there might be an additional way to mount a different type of plaintext
which is independent of the recipient's reply:


Alice pgp encrypts a message to Bob, and by default, simultaneously to

Alice can use gnupg to obtain the session key for the message, by
decrypting the default encrypted message to her own key.

The session key, can now be used as a known plaintext,
the packet of the session key encrypted to Bob's public key, is the

and Bob's [ private key + passphrase hash ] the unknown, that is sought.


if we assume that:
(a) Alice can use a watered-down implementation of pgp that does not use


(b) Alice can intentionally use a flawed 'crackable' algorithm to encrypt 
Bob's key
{like using an 'experimental algo' in gnupg, but finding/making one that 
easily cracked, or trivial to begin with}

is it possible for Alice to retrieve Bob's [private key + passphrase 
which could then be used to decrypt  other messages encrypted to Bob's key