oss-security - Re: broken RSA keys

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 5 May 2016 14:21:14 +0300
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: broken RSA keys

On Thu, May 05, 2016 at 01:03:36PM +0200, Hanno B??ck wrote:
> On Thu, 5 May 2016 13:34:05 +0300 Solar Designer <solar@...nwall.com> wrote:
> > On Wed, May 04, 2016 at 09:18:26PM -0400, Stanislav Datskovskiy wrote:
> > > older versions of GPG
> > > will regard the bottom 32 bits of a modulus as the 'fingerprint',
> > > rather than performing a hash.
> > 
> > Are you sure?
> 
> https://tools.ietf.org/html/rfc4880
> 
> "V3 keys are deprecated.  They contain three weaknesses.  First, it is
> relatively easy to construct a V3 key that has the same Key ID as any
> other key because the Key ID is simply the low 64 bits of the public
> modulus."

Thanks.  I guess when I imported a PGP 2.6 key to GPG, I just did not
notice this detail, and GPG continued to use the V3 format key for me.

Also from the RFC above:

"  For a V3 key, the eight-octet Key ID consists of the low 64 bits of
   the public modulus of the RSA key.

   The fingerprint of a V3 key is formed by hashing the body (but not
   the two-octet length) of the MPIs that form the key material (public
   modulus n, followed by exponent e) with MD5.  Note that both V3 keys
   and MD5 are deprecated."

So key id was not part of the fingerprint.  That's not how I remember
it, but I'll trust the RFC over my memory.

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.