Full Disclosure mailing list archives
RE: RE: [security] A Nasty Security Bug that affectPGP Virtual Disks & PGP SDA , PGP 8.x & 9.x and Truecrypt.
From: "Pedro Hugo" <phugo () highspeedweb net>
Date: Sat, 27 May 2006 14:51:04 +0100
Hello,
No, what he's saying is that if you can subvert the PGP software at a point
after it has both the secret key and the
passphrase and has combined them, you can get access to the files.
What he didn't said and wasn't explicit, was the possibility to decrypt the files after he bypassed the authentication. For me, it's implicit that the encryption key is the passphrase, that's what makes sense, and that's PGP answer to this (you don't know the key, you can't decrypt!). What he did was bypassing the authentication phase, not the decryption. My question was if the passphrase was used just for authentication layer, and a fixed key was used for encryption (very very dumb possibility, but you never know!). In his paper he says can see the files... Good. But it doesn't say anything about retrieving those files. Well... He says if he uses a debugger he can do that. I seriously doubt it. That doesn't make sense because he never retrieved the encryption key, he just replaced it. Unless he can demonstrate the decryption without the original key, this is not that NASTY BIG bug that appears to be. It's an important bug, because it compromises the content of the encrypted disk due to the file listing possibility. What's the validity of something like this in court ? Since the files are still encrypted, it's not possible to create a checksum for those files and compare with a known value. Regards, Pedro _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- RE: [security] A Nasty Security Bug that affect PGP Virtual Disks & PGP SDA , PGP 8.x & 9.x and Truecrypt. fractalg (May 26)
- Re: RE: [security] A Nasty Security Bug that affect PGP Virtual Disks & PGP SDA , PGP 8.x & 9.x and Truecrypt. Valdis . Kletnieks (May 26)
- RE: RE: [security] A Nasty Security Bug that affectPGP Virtual Disks & PGP SDA , PGP 8.x & 9.x and Truecrypt. Pedro Hugo (May 27)
- Re: RE: [security] A Nasty Security Bug that affect PGP Virtual Disks & PGP SDA , PGP 8.x & 9.x and Truecrypt. Valdis . Kletnieks (May 26)