Re: Beginner Question:Gnupg Decryption

On Mar 26, 1:14 am, "MichiMichi" <wwwm...@xxxxxx> wrote:

That made me think. If one email recipients uses a weak key, other
email recipients could burteforce the message and easily detect weak
passwords.

this could happen, but is not likely,
and, (except for one case listed below), has nothing to do with
passwords

ordinarily a 'weak' key is understood as one whose keylength is small
enough to be brute forced, (i.e. 1024 or less),
and then an attacker could obtain the session key and decrypt the
message

in practice,
the sender *knows* the keysizes of all keys chosen for encryption,
(and gnupg even 'reminds' the sender of this before encrypting)
so the sender would usually not select such a key


what might be a potential problem, is the following:

it is possible to have gnupg encrypt to public keys, and at the same
time,
also encrypt symmetrically
(to a user who doesn't have access to the keyring, or prefers not to
use a public key)

when gnupg does this, the *same* session key is encrypted both to the
public key,
so,
if Bob sends a GnuPG message encrypted to Alice's public key,
and symmetrically to Eve, using a passphrase that both Bob and Eve
have agreed upon beforehand,
then
it may be possible (but not 'easy' ), for Alice to recover this
passphrase,
as she has the session key and the ciphertext,
(but not the salt )


vedaal

.

Relevant Pages

  • Re: GnuPG in the enterprise
    ... >> the rights to revoke that user's public key, and be able decrypt any ... Just so I'm following then, let's say I have gnupg installed on my server, ... revoking the key themselves and creating a new public key, ... that requires encryption, when I encrypt the message, won't it get ...
    (freebsd-questions)
  • Re: Two way encryption with PHP - some libraries for doing this?
    ... > Up until now I have been storing passwords in the database as an sha1 hash. ... With GnuPG / PGP you could put your public key on the server. ... a script that uses that public key to encrypt the data. ...
    (comp.lang.php)
  • Re: Ideas please
    ... Store them in the clear? ... encrypted to your own public key. ... I use Gnu Privacy Guard (GnuPG), ... and thereafter everything you encrypt would ...
    (sci.crypt)
  • Re: how to have a gpg public key?
    ... Having just a public key doesn't do you much good. ... You need both a private key and a public key; ... can encrypt and decrypt your messages and you are just ...
    (Debian-User)
  • Re: RSA Encrypt/Decrypt Problems
    ... You can generate a snk for each and replicate the public key part to each ... Then sym encrypt your data with the key and iv and store in the ... You could actually do it with small blocks and only the public rsa key, ... > key) with the symmetric key embedded in the file and encrypted using the ...
    (microsoft.public.dotnet.security)