Subject: Cryptologists Discover Flaw in PGP

From: "Robert C. Lyons" <[email-masked]>
Date: Wed, 21 Mar 2001 10:31:22 -0500

See http://www.i.cz/en/onas/tisk4.html
for the official press release.

The flaw sounds serious. In a nutshell, a
hacker can obtain your private key if
he can obtain your private key file
and a message signed by your private key.
Your private key file contains your
encrypted private key, which is decrypted
using your passphrase. PGP users believe
that the private key file is useless
unless you know the passphrase. It turns
out that that belief is not true.

A technical paper about the flaw will
be available at http://www.icz.cz/ (or
http://www.icz.cz/en/index.html for
non-Czech speakers) on Friday.

Page A14 of today's New York Times also
has the story.

Best regards,

Bob

<sig name    = 'Bob Lyons'
     title   = 'B2B Integration Consultant'
     company = 'Unidex, Inc.'
     phone   = '+1-732-975-9877'
     email   = [email-masked]'
     url     = 'http://www.unidex.com/'
     product = 'XML Convert: transforms flat files to XML and vice versa' />

---

From: "Harter, Shan" <[email-masked]>
Date: Wed, 21 Mar 2001 15:22:24 -0700

Agreed.

Shan

«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»
Systrends, Inc. - "Your window to EC today"
Shan Harter
Office:480-756-6777, ext 220  FAX:480-756-9755
Mobile:602-821-2951, Efax: XXX-XXX-XXXX
web: www.systrends.com
«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»

-----Original Message-----
From: Amaron [mailto:[email-masked]]
Sent: Wednesday, March 21, 2001 2:53 PM
To: [email-masked]
Subject: Re: Cryptologists Discover Flaw in PGP

I can't believe where people may have gotten the idea that the private key
is safe or useless without the passphrase.  The proponents of PGP have
always said that you must keep your private key safe.  After all, most
people will not use a passphrase much longer than a normal password - eg. 8
to 12 characters which is easily broken using an automated trial and error
attack, once you have the private key file and an encrypted message.  Isn't
that why smart-cards were invented?

This supposed 'revelation' is nothing of the sort; it's just a fact that has
not been as widely published as it should have been.
Regards,
Bjorn Schmid.