Question for PGP Gurus

PGP gurus, 

I don't follow the ins and outs of PGP very closely, and I can't find
anything on this directly in my archived articles.

Someone has told me that pre-MIT versions of PGP may have compromised
security because "the session key is hashed solely from the
plaintext."

Is this true? What's the significance? Is there any weakness?


Thanks,

--Tim


-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^859433 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."

> Someone has told me that pre-MIT versions of PGP may have compromised
> security because "the session key is hashed solely from the
> plaintext."
> 
> Is this true? What's the significance? Is there any weakness?

This is not true.  The session key is based upon random input (key
timings from the passphrase, and other sources of random input) as
well as the randseed.bin file, which was generated by random
keypresses at key generation.  (It may also include other sources of
randomness as well; I do not recall).

This is only for the random session keys.  If you use conventional
crypto mode (pgp -c), then the IDEA key is based solely on the hash of
the passphrase, and I believe the IV is not random (maybe it should be
a random IV?)

Hope this helps, Tim.

-derek

-----BEGIN PGP SIGNED MESSAGE-----

In list.cypherpunks, tcmay:

> PGP gurus, 
> 
> I don't follow the ins and outs of PGP very closely, and I can't find
> anything on this directly in my archived articles.
> 
> Someone has told me that pre-MIT versions of PGP may have compromised
> security because "the session key is hashed solely from the
> plaintext."
> 
> Is this true? What's the significance? Is there any weakness?

It's not true.  The MD5 hash of the plaintext is used as a part of the
overall session key generation, if available.  Here's a comment from
~/pgp23/src/crypto.c:

    /*  Now we have to generate a random session key and IV.
        As part of this computation, we use the MD5 hash of the
        current file, if it has previously been obtained due to a
        signing operation.  If it has not been obtained, we hash
        the first 2K (for efficiency reasons) for input into
        the key generatrion process.  This is to ensure that
        capturing a randseed.bin file will not allow reconstruction
        of subsequent session keys without knowing the message
        that was encrypted.  (A session key only protects a
        single message, so it is reasonable to assume that an
        opponent trying to obtain a session key is trying to
        obtain, and thus is ignorant of, the message it encrypts.)

        This is not perfect, but it's an improvement on how session
        keys used to be generated, and can be changed in future
        without compatibility worries.
    */

The hash of the current file is combined with the contents of
randseed.bin.  Looks like the hash value is being used to gain a few
bits of entropy that can't be recovered from randseed.bin alone.

Checking the 2.6 code, I find the MD5 of the current file is used in the
random session key generation, but slightly differently:

 * The MD5 of the current file is used to "prewash" the random numbers,
 * to make it more difficult for an attacker to predict the output.

If the key were solely hashed from the plaintext, that could make for
some known-plaintext attacks.  But since a new session key is used each
time, there doesn't seem to be much value in it.  As it is, I don't see
a problem with the session key generation using the file hash as a part
of its entropy.

Then again, could an IDEA session key be recovered by a known-plaintext
attack?  If so, could a known-plaintext attack then be made against RSA?
(for that matter, is RSA vulnerable at all to known-plaintext attack?)
- -- 
    Roy M. Silvernail       |  #include <stdio.h>            | PGP 2.3 public
roy@sendai.cybrspc.mn.org   |  main(){                       | key available
                            |  int x=486;                    | upon request
                            |  printf("Just my '%d.\n",x);}  | (send yours)

-----BEGIN PGP SIGNATURE-----
Version: 2.6

iQCVAwUBLhiMeRvikii9febJAQH/GQP8C/fNNkxlhz1vMnyNbyxdT9UeMUKrE4I8
bmyfWYSV9RxBQZR6OA2tU2hUWiX5Yvycn/IYYmxYbFEkio1zDSRuhit3svB1LPQY
lzBhkaf+Uqjl7zx5HFD7ON+0kjr8D01r4g+HQceQwep4jOWTXZ/OZKas/aiOqhH7
Pv08H0BEpps=
=ZtUN
-----END PGP SIGNATURE-----