|
Message-ID: <20160505112114.GA25313@openwall.com> Date: Thu, 5 May 2016 14:21:14 +0300 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: broken RSA keys On Thu, May 05, 2016 at 01:03:36PM +0200, Hanno B??ck wrote: > On Thu, 5 May 2016 13:34:05 +0300 Solar Designer <solar@...nwall.com> wrote: > > On Wed, May 04, 2016 at 09:18:26PM -0400, Stanislav Datskovskiy wrote: > > > older versions of GPG > > > will regard the bottom 32 bits of a modulus as the 'fingerprint', > > > rather than performing a hash. > > > > Are you sure? > > https://tools.ietf.org/html/rfc4880 > > "V3 keys are deprecated. They contain three weaknesses. First, it is > relatively easy to construct a V3 key that has the same Key ID as any > other key because the Key ID is simply the low 64 bits of the public > modulus." Thanks. I guess when I imported a PGP 2.6 key to GPG, I just did not notice this detail, and GPG continued to use the V3 format key for me. Also from the RFC above: " For a V3 key, the eight-octet Key ID consists of the low 64 bits of the public modulus of the RSA key. The fingerprint of a V3 key is formed by hashing the body (but not the two-octet length) of the MPIs that form the key material (public modulus n, followed by exponent e) with MD5. Note that both V3 keys and MD5 are deprecated." So key id was not part of the fingerprint. That's not how I remember it, but I'll trust the RFC over my memory. Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.