Subject: Re: SHA-1 broken

From: [email-masked]
Date: Fri, 18 Feb 2005 00:39:16 +0100

Ian G <[email-masked]> wrote on 17 Feb 2005:

 >>Please, let us stop making any "change announcements" to the public if
 >>there is not an actual security problem to be solved!
 >
 >Well, I'm not sure anyone has made any
 >"change announcements" unless you mean
 >that recent minor oracle attack.

That is exactly what I meant: the announcement of Jon et al.
regarding the "minor oracle attack".

 >It seems that we have to go through a
 >period of actually revealing these things
 >and encouraging people not to panic.
 >
 >Elsewise we go back to the bad old days
 >where we keep all quiet.

I was not suggesting to "keep quiet" any real weaknesses. But the
proper handling for the publication of the "oracle attack" would have
been to point out that no mail application based on OpenPGP was
susceptible to the circumstances of the attack, and that implementing
an "oracle" is considered a Really Stupid Thing (TM).

The short mention in the announcement that the OpenPGP group would be
changing the protocol due to the "oracle attack publication", was
interpreted by the media as a "proof" of the fact that a serious
problem had been found - which was not the case at all. The "attack"
may have been interesting from a mathematical viewpoint, but it was
never relevant to the reality of e-mail applications. If a recipient
is so stupid as to send me back thousands of "I can't read your mail"
answers, this same user will surely be stupid enough to send me his
private PGP key + passphrase if I devise a proper social engineering
or phishing attack. So the problem here is the fact of having an
"oracle" (implemented as a stupid user or a stupid programmer) in the
first place, and lies _not_ with the protocol.

Therefore, let us solve the problem where it is, and not at some other
place!

- Wolfgang Redtenbacher

---------------------------------------------------------------------
Redtenbacher Software                Tel.:   +49 7159 17046
Roemerstr. 11/1                      Fax:    +49 7159 17047
D-71272 Renningen                    e-mail: [email-masked]
---------------------------------------------------------------------

---

From: Werner Koch <[email-masked]>
Date: Fri, 18 Feb 2005 12:51:54 +0100

> susceptible to the circumstances of the attack, and that implementing

We don't know.

> an "oracle" is considered a Really Stupid Thing (TM).

The sad thing is that oracles are very common.  On the positive side
you have the fact that people don't interpret error messages properly
because that is too much work and just return a Bollean value - by
that they defeat this particular attack (maybe except for LANs).

> is so stupid as to send me back thousands of "I can't read your mail"

Heise clearly pointed out that the attack won't work for attended
usage.

Salam-Shalom,

   Werner