Software Engineering Institute

Additional Decryption Keys
A serious problem in the handling of certificates used with PGP versions 5 and 6 has recently been discovered by Ralf Senderek. A detailed description of his research into this issue and it's conclusions can be found at:

http://senderek.de/security/key-experiments.html

Attackers who are able to modify a victim's public certificate may be able to recover the plaintext of any ciphertext sent to the victim using the modified certificate.

For this vulnerability to be exploited, the following conditions must hold:

• the sender must be using a vulnerable version of PGP
• the sender must be encrypting data with a certificate modified by the attacker
• the sender must acknowledge a warning dialog that an ADK is associated with the certificate
• the sender must already have the key for the bogus ADK on their local keyring
• the bogus ADK must be a certificate signed by a CA that the sender trusts
• the attacker must be able to obtain the ciphertext sent from the sender to the victim

Apply a patch
Network Associates has produced a new version of PGP 6.5 which corrects this vulnerability by requiring that the ADK be included in the signed portion of the certificate.

Check certificates for ADKs before adding them to a keyring.
Users of PGP who want to ensure that they are not using a modified certificate should check for the existence of ADKs when adding new keys to their keyring. Certificates that do not have ADKs are not vulnerable to this problem. Certificates which do have ADKs may be legitimate or modified and should be confirmed using an out-of-band communication.

Users of PGP 6.x for Windows and MacOS can test for the presence of ADKs in a certificate by right clicking on the certificate and selecting "Key Properties". If the ADK tab is present, the key has one or more ADKs and might be a malicious certificate. We are not aware of a way to identify ADKs in the UNIX command line version of PGP 5.x or 6.x.

Users of GnuPG can test for certificates with ADKs by running the command

gpg --list-packet

Certificates with legitimate ADKs will contain in the output

hashed subpkt 10 len 23 (additional recipient request)

while those missing the "hashed" keyword

subpkt 10 len 23 (additional recipient request)

appear to indicate maliciously modified certificates.

Make a reliable copy of your public certificate publicly available.
Since the recipient of messages encrypted with a modified certificate cannot prevent the plaintext from being recovered by the attacker, their best course of action is to ensure that senders are able to easily obtain legitimate copies of their public certificate.

Until this problem has been widely corrected, you may wish to make your legitimate certificate available in a location that is strongly authenticated using a different technology, or to make it available in more than one place.

For example, the CERT/CC PGP certificate does NOT contain any ADKs, and a legitimate version can be obtained from our SSL secured web site at

https://www.cert.org/pgp/cert_pgp_key.asc

You may also want to check that your public certificate has not been modified on the public certificate servers. Changes are likely to be made to the popular PGP certificate servers to detect and reject invalid certificates that attempt to exploit this vulnerability.