oss-sec mailing list archives
Re: Re : Re: [oss-security] Re : Re: [oss-security] CVE-2018-12020 in GnuPG
From: Stephen Farrell <stephen.farrell () cs tcd ie>
Date: Wed, 13 Jun 2018 10:30:00 +0100
Hiya, On 12/06/18 21:56, Stiepan wrote:
Hi Yves-Alexis, Any updates on this? By the way, it might be the occasion to switch to more future-proof signatures, such as https://datatracker.ietf.org/doc/rfc8391 , which are reputed as quantum-safe and do not depend on some hardness assumptions.
XMSS (RFC8391) seems like a fine thing to me, but two notes: 1. There's another hash based scheme [1] that may or may not have more traction, depending whom you ask. 2. IIUC these schemes have a finite number of signatures per private key, and when you've used them all you reveal the private key value, so different APIs are needed, and applications need to care about that. So I'm not sure that general adoption of these for gnu-pg would be simple. In this context though (s/w signing), applications could make use of 'em, if done carefully. The best list for discussing algorithm details is probably the CFRG list. (cfrg () ietf org) Cheers, S. [1] https://datatracker.ietf.org/doc/draft-mcgrew-hash-sigs/
We could help with an open-source implem. if needed. Apparently, NIST is also moving into that direction for software signatures, according to information given now at ETSI's security week. Best regards, Stiepan A. Kovac President itk AVtobvS SARL Envoyé depuis ProtonMail mobile -------- Message d'origine -------- On 10 juin 2018 à 18:38, Yves-Alexis Perez a écrit :On Sun, 2018-06-10 at 10:58 -0400, Stiepan wrote: Hi Stepian,This responsibility discussion is all well and fine, but now that this is half-public, may we know for sure whether we are affected : 1. as debian(-like) package consumersNot entirely sure what you mean here, but if you're talking about the apt package managers (which relies on gpgv for signature verification), it's currently investigated. Note that all supported suites have had their gnupg version updated: https://s ecurity-tracker.debian.org/tracker/CVE-2018-12020 Regards, -- Yves-Alexis
Attachment:
0x5AB2FAF17B172BEA.asc
Description:
Current thread:
- CVE-2018-12020 in GnuPG Yves-Alexis Perez (Jun 08)
- Re: CVE-2018-12020 in GnuPG Marcus Brinkmann (Jun 09)
- Re : Re: [oss-security] CVE-2018-12020 in GnuPG Stiepan (Jun 10)
- Re: Re : Re: [oss-security] CVE-2018-12020 in GnuPG Yves-Alexis Perez (Jun 10)
- Re : Re: [oss-security] Re : Re: [oss-security] CVE-2018-12020 in GnuPG Stiepan (Jun 13)
- Re: Re : Re: [oss-security] Re : Re: [oss-security] CVE-2018-12020 in GnuPG Stephen Farrell (Jun 13)
- Re : Re: [oss-security] CVE-2018-12020 in GnuPG Stiepan (Jun 10)
- Re: CVE-2018-12020 in GnuPG Marcus Brinkmann (Jun 09)