Just to point out, this attack goes back at least 22 years. According to [this thread](https://groups.google.com/forum/#!topic/sci.crypt/JSSM6Nbfwe...), credit is due to Paul Leyland.
Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
101–110 of 131 posts
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#102As mentioned in debian-devel lists, add this to your ~/.gpg.conf: keyid-format long as a stop gap measure, it will show long IDs (64-bit). Obviously comparing full key (`--with-fingerprint`) is the best.
Someone claims (https://groups.google.com/forum/#!topic/sci.crypt/JSSM6Nbfwe...) that it's just as easy to spoof 64 bit as 32 bit keys. I have no idea whether to believe him, but even if he's full of it, it's prudent to assume that if the 32 bit attack was practical 20 years ago, 64 bits is within reach today.
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#103Earlier quoted context omitted.
> users who want to email someone discover their key by searching the keyserver for that email, then taking the newest key. This is akin to trust-on-first-use, and opts out completely from the web of trust or any kind of external verification Well, yes? What is the alternative, if I want to email someone who exists only in the form of a pseudonymous online identity?
Most of the time there's some at least semi-trusted communication channel. If they have a website, ask them to publish the key or the full fingerprint on their website. If they frequent some IRC channel, ask them on IRC for their key's fingerprint. If they regularly sign their emails you can check mailing lists they participate on to confirm they use the same key there. If the key is just for their pseudonym, I usual…
I guess you're talking, here, about identities that are at least in some way connected to the "public" social network. Identities that publish things on public websites, etc.
But if this isn't true—if, for example, you are someone who wants to get in contact with a terrorist group (maybe for an interview, maybe because you want to join them, etc.) then there's not much to do but to trust-on-first-use some channel that seems to be them, no? No public channel can possibly be vouched for as being "the real them", or that channel would have been chased up by the CIA. Which means that any/every channel might just be a honeypot from the CIA or whoever else, trying to either frustrate your efforts, or convert you into a double-agent.
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#104I've attended security conferences in the past two years wherein representatives of companies that claim to see 80+ percent of all Internet traffic in their threat intel offerings who were presenting about Android malware reverse engineering used short IDs in their slide deck and business cards. When I mentioned Evil32 to them, they looked at a loss. https://evil32.com If this is news to you, don't feel bad. Many inf…
I'm just some guy, but I've got a stack of cards with my short ID on them - what do I do now? Toss them?
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#105Earlier quoted context omitted.
Most of the time there's some at least semi-trusted communication channel. If they have a website, ask them to publish the key or the full fingerprint on their website. If they frequent some IRC channel, ask them on IRC for their key's fingerprint. If they regularly sign their emails you can check mailing lists they participate on to confirm they use the same key there. If the key is just for their pseudonym, I usual…
I guess you're talking, here, about identities that are at least in some way connected to the "public" social network. Identities that publish things on public websites, etc. But if this isn't true—if, for example, you are someone who wants to get in contact with a terrorist group (maybe for an interview, maybe because you want to join them, etc.) then there's not much to do but to trust-on-first-use some channel tha…
The bigger terrorist groups all have websites and/or a social media presence.
As you say any one of those channels could be a CIA operation, that's why asking for verification from two independent channels (i.e. asking for the keyfile on one channel, for the fingerprint on another) is preferable. A terrorist group that actually uses pgp might even entertain you if you ask on more than two channels for the fingerprint. The more channels you chose, the less likely it is that a single attacker controls all of them.
Another factor is that any public channel that is a front is likely to be called out sooner or later as a non-official channel. Most people and organizations are wary of the dangers of impersonation.
Of course there will always be situations where it's impossible to establish trust, like a leak by a group who tries to stay anonymous to the point of not associating with any previously used pseudonyms. Here you can't do anything but trust the first communication. But I think those cases are extremely infrequent: most groups and individuals try to establish a reputation, which nearly always gives you more points to anchor trust.
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#106I've mentioned an idea in Phoronix forums[1] yesterday:
Since most users won't bother comparing the entire signature (also applies to comparing md5/sha*/etc. hashes), it might be a good idea to map & display blocks of the sig as English words to the user.
Care must be taken to avoid similar-looking and similar-sounding (homophonic) words, but since there are >150k words in Oxford English Dictionary, so it should be possible to get 65k usable ones.
In fact, someone pointed out something like this already exists to a degree: [2]
A contrived visual example (suppose someone matches first two and last two segments!):
Fake Linus Torvalds: ABAF 11C6 32D8 69AE E438 F74B 6211 AA3B 0041 1886
Real Linus Torvalds: ABAF 11C6 5A29 70B1 30AB E3C4 79BE 3E43 0041 1886
Fake Linus Torvalds: lopsided crate threatening hydrant peep bumpy art work earth spurious
Real Linus Torvalds: lopsided crate symptomatic equal kaput chunky kettle include earth spurious
(random words from [3])
[1] https://www.phoronix.com/forums/forum/phoronix/latest-phoron...
[2] https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi...
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#107Earlier quoted context omitted.
Why is this scary?
Because it removes many obvious tells of a deliberate key collision targeting a specific key, and thus is harder to detect. For example, pgp.mit.edu and Enigmail would currently output information for both keys that would be almost identical per 2014-08-05, the day evil32 apparently generated the keys. I say "almost" only because they didn't set the correct timestamps, and apparently did not duplicate all UIDs -- but…
The whole point of this research was to underscore that PGP key acquisition is commonly broken. You could choose to blame PGP software, users, documentation, or the web-of-trust model itself, but in any case what a significantly number of people commonly do is unsafe.
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#108So my solution to this was to sign a ton of publicly archived email with my full fingerprint. Then I stopped signing email and not a single person noticed/cared, so yeah. Meh. CVE assignments, no big deal I guess.
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#109Earlier quoted context omitted.
Pretty sure most of the time people only read the first few and last words and e.g. don't concern if the words in the middle are in correct order. Not sure about the size of that dictionary, but it would seem to greatly diminish the entropy.
It's asking for a solution with more gestalt impact. Turn the key into a painting or some sort of visualization.
Whether it is vision or words, the point is to enlist some of our primal, automatic brain machinery. Both the random word lists and randomart are a good start, but far from perfect.
The word lists ignore and even foil, our gramatical machinery. And I at least have never been able to remember what my own randomart SSH key fingerprint looked like. Adding colour might be a good start.
Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs
#110As mentioned in debian-devel lists, add this to your ~/.gpg.conf: keyid-format long as a stop gap measure, it will show long IDs (64-bit). Obviously comparing full key (`--with-fingerprint`) is the best.
Someone claims ( https://groups.google.com/forum/#!topic/sci.crypt/JSSM6Nbfwe... ) that it's just as easy to spoof 64 bit as 32 bit keys. I have no idea whether to believe him, but even if he's full of it, it's prudent to assume that if the 32 bit attack was practical 20 years ago, 64 bits is within reach today.
That's a post from 1996. I'm not sure how "easy" was calculated. Possibly both were hard but tractable, but 64 bits should have been much harder.
Today it is significantly easier to collide a 32-bit key than a 64-bit one, but both are pretty easy. A 32-bit key can be collided in 4 seconds on a GPU, according to https://evil32.com. It can certainly be done on normal desktop hardware in hours. For a 64-bit key, 'JoshTriplett calculated (last week) that a collision would take 15 days if someone built hashing hardware of comparable quality to a commercial Bitcoin miner:
https://lists.debian.org/debian-devel/2016/08/msg00215.html
(Incidentally, I am very pleased with Bitcoin having created a liquid market between cryptographic computational speed and money, so we can answer these sorts of questions precisely.)