No need to go through all the gyrations, since Bob's public key is public
and known to her. She can perform chosen plaintext attack on the key all
she wants, with specialized tools and hardware. No need to only use known
session keys for whole messages encrypted by PGP; just run RSA or DSA
yourself on any chosen material.
It is a fundimental requirement that a public key algorithm be able to
withstand such an attack. The existance of a "weak block" would imply
that the function is not one-way after all.
--John
"vedaal" <vedaal(_at_)hotmail(_dot_)com>
Sent by: owner-ietf-openpgp(_at_)mail(_dot_)imc(_dot_)org
08-20-2002 04:40 PM
To: <ietf-openpgp(_at_)imc(_dot_)org>
cc:
Subject: possible new type of pgp plaintext attack ?
atfer reading the paper on the pgp reply/plaintext attack, was wondering
if
there might be an additional way to mount a different type of plaintext
attack,
which is independent of the recipient's reply:
consider:
Alice pgp encrypts a message to Bob, and by default, simultaneously to
herself.
Alice can use gnupg to obtain the session key for the message, by
decrypting the default encrypted message to her own key.
The session key, can now be used as a known plaintext,
the packet of the session key encrypted to Bob's public key, is the
ciphertext,
and Bob's [ private key + passphrase hash ] the unknown, that is sought.
now,
if we assume that:
(a) Alice can use a watered-down implementation of pgp that does not use
'salt'
and
(b) Alice can intentionally use a flawed 'crackable' algorithm to encrypt
to
Bob's key
{like using an 'experimental algo' in gnupg, but finding/making one that
is
easily cracked, or trivial to begin with}
then,
is it possible for Alice to retrieve Bob's [private key + passphrase
hash],
which could then be used to decrypt other messages encrypted to Bob's key
?
TIA,
vedaal