Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Data Protection

Critical Vulnerability Patched in GnuPG, Libgcrypt

The GnuPG Project announced last week the availability of GnuPG and Libgcrypt updates that address a critical security problem affecting all versions released over the past 18 years.

The GnuPG Project announced last week the availability of GnuPG and Libgcrypt updates that address a critical security problem affecting all versions released over the past 18 years.

GNU Privacy Guard, also known as GnuPG and GPG, is a free implementation of the OpenPGP standard. Offered as an alternative to the PGP cryptographic software suite, GPG is used by several applications, including popular email encryption tools. Libgcrypt is a general purpose crypto library based on GPG.

Researchers Felix Dörre and Vladimir Klebanov from the Karlsruhe Institute of Technology in Germany discovered a problem in the mixing function of the Libgcrypt pseudorandom number generator (PRNG).

“Due to the flaw, mixing the full entropy pool reduces the stored entropy amount by at least 20 bytes. Furthermore, the flaw makes a part of the PRNG output completely predictable,” the experts wrote in a paper detailing the issue.

According to Werner Koch, the developer of GnuPG, an attacker who obtains 4640 bits from the RNG can easily predict the next 160 bits of output.

“A first analysis on the impact of this bug in GnuPG shows that existing RSA keys are not weakened. For DSA and Elgamal keys it is also unlikely that the private key can be predicted from other public information. This needs more research and I would suggest _not to_ overhasty revoke keys,” Koch said in a security advisory.

The vulnerability, tracked as CVE-2016-6313, affects all versions of GnuPG and Libgcrypt released since 1998. The issue has been resolved with the release of Libgcrypt 1.7.3, 1.6.6 and 1.5.6 for GnuPG-2 2.0.x and 2.1.x, and GnuPG 1.4.21 for GnuPG-1 version 1.4.x. Software projects using GnuPG and Libgcrypt are expected to release updates of their own.

GPG hit a rough patch in 2014 due to the lack of funding. However, Koch managed to attract the attention of the media, which resulted in tens of thousands of dollars in individual donations and a one-time grant of $60,000 from the Linux Foundation’s Core Infrastructure Initiative. In addition, Facebook and payment processor Stripe pledged to donate $50,000 per year to help sustain the project.

Advertisement. Scroll to continue reading.

Related: Several Vulnerabilities Patched in Libarchive Library

Related: Remote Code Execution Flaw Patched in glibc Library

Related: “Libotr” Library Flaw Exposes Popular IM Apps

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

People on the Move

Former DoD CISO Jack Wilmer has been named CEO of defensive and offensive cyber solutions provider SIXGEN.

Certificate lifecycle management firm Sectigo has hired Jason Scott as its CISO.

The State of Vermont has appointed John Toney as the state’s new CISO.

More People On The Move

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

Artificial Intelligence

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.

Compliance

The three primary drivers for cyber regulations are voter privacy, the economy, and national security – with the complication that the first is often...

Data Protection

While quantum-based attacks are still in the future, organizations must think about how to defend data in transit when encryption no longer works.

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...

Cybersecurity Funding

Los Gatos, Calif-based data protection and privacy firm Titaniam has raised $6 million seed funding from Refinery Ventures, with participation from Fusion Fund, Shasta...