Re: How regularly is the GnuPG source code examined?

From: David Wagner (daw_at_taverner.cs.berkeley.edu)
Date: 09/28/05 

Date: Tue, 27 Sep 2005 22:41:51 +0000 (UTC)

Unruh wrote:
>So, let us restrict ourselves to asking whether the program could be
>altered in such a way that the attacker, intercepting only the output from
>the program, could gain enough information to decrypt it easily. Could such
>a backdoor be installed undetectibly into the program. I would argue no.

I already gave one example of an apparently accidental bug in PGP that
(a) allowed to attacker, intercepting only the output of the program,
to gain enough information to decrypt it easily; (b) could have been
inserted by an insider; (c) was in fact not detected for a long time.
I am sure one could find other such examples. If it possible for this
to happen by mischance, I think we'd better be prepared that it could
happen due to malice, too.

Relevant Pages