atfer reading the paper on the pgp reply/plaintext attack, was wondering if
there might be an additional way to mount a different type of plaintext
attack,
which is independent of the recipient's reply:
consider:
Alice pgp encrypts a message to Bob, and by default, simultaneously to
herself.
Alice can use gnupg to obtain the session key for the message, by
decrypting the default encrypted message to her own key.
The session key, can now be used as a known plaintext,
the packet of the session key encrypted to Bob's public key, is the
ciphertext,
and Bob's [ private key + passphrase hash ] the unknown, that is sought.
now,
if we assume that:
(a) Alice can use a watered-down implementation of pgp that does not use
'salt'
and
(b) Alice can intentionally use a flawed 'crackable' algorithm to encrypt to
Bob's key
{like using an 'experimental algo' in gnupg, but finding/making one that is
easily cracked, or trivial to begin with}
then,
is it possible for Alice to retrieve Bob's [private key + passphrase hash],
which could then be used to decrypt other messages encrypted to Bob's key ?
TIA,
vedaal