GnuPG has a serious flaw that compromises any ElGamal key used for signing or encrypting material. When GnuPG creates ElGamal sign+encrypt keys (type 20), it does so in a cryptographically weak way. This can be exploited to compromise the private key.
Classification
Location:
Local Access Required,
Remote / Network Access
Attack Type:
Cryptographic
Impact:
Loss of Confidentiality,
Loss of Integrity
Solution
Upgrade to version 1.2.3 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the patch provided by the vendor, which is applied to vulnerable 1.2.3 distributions.
ens.fr -
École normale supérieure
