Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SKS Keyserver Network Under Attack

gist.github.com

Post reply on HN
Print view View original

191–197 of 197 posts

Re: SKS Keyserver Network Under Attack

#191

Post by omeid2 »

yegortimoshenko wrote: post #149
tptacek wrote: post #76

I'd like to gingerly suggest that this is not the way a project that has deliberately set as its adversaries hostile world governments should respond to a trivial, predictable† vandalism attack. Rather, if they're serious about what they're doing – Hansen, in a related document, talks about the "good advice" he gave to dissidents in Venezuela about using GnuPG – they should thank whoever did this. This attack apparen…

Can confirm, I've reported a similar attack [1], along with a few other vulnerabilities, and also published exploit tools. I ended up getting legal threats from two people that I see frequently posting to sks-devel@ mailing list. Additionally, Robert (GnuPG maintainer who wrote this Gist) has attacked [2] another person who wrote a proof-of-concept filesystem on top of SKS that was intended to highlight how broken th…

> if attacker were to deliberately try to break SKS, they would target someone like Linus Torvalds.

I wish they did, as I am hoping for an outcome similar to bitkeeper/git.

Re: SKS Keyserver Network Under Attack

#192

Post by xKINS »

tptacek wrote: post #59
Sir_Cmpwn wrote: post #56

Earlier quoted context omitted.

Efail was a symptom of bad PGP implementations in email clients, not a flaw in PGP. It was overblown trash designed to bring fame to the "discoverers" at the expense of the reputation of PGP and its authors. If you think that this statement doesn't belong here, you can take it up with the mods, a group which spending lots of time on HN does not qualify you for.

Adding a personal attack against me doesn't make your bogus, amoral argument any more acceptable.

Internet point king here, but has done nothing in the last decade. Enjoy your meaningless fame.

Re: SKS Keyserver Network Under Attack

#193

Post by KirinDave »

Arathorn wrote: post #176
jeduardo wrote: post #172

Earlier quoted context omitted.

Do you have more info about this? As far as I understand if you use e2e encryption with riot/matrix you should be quite safe.

I imagine the GP is talking about https://news.ycombinator.com/item?id=20178267 . We've spent the last few weeks going through fixing the issues which this highlighted; there'll be a blog post later today (or tomorrow) giving an update on how we've addressed the points in question.

Yeah I wrote this before I saw that blog post which appears to have hit most of the implications.

Re: SKS Keyserver Network Under Attack

#194

Post by cbsmith »

pvg wrote: post #82
cbsmith wrote: post #24

Earlier quoted context omitted.

That wasn't an argument... It was an expression of confusion as to why the author would say what they said.

It's not. This thing: https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d695... is not an 'expression of confusion', it's an attempt at offtopic shitstirring and mockery. It's kind of dumb in the gist - keeping it up on HN (where it's sensibly forbidden) is worse.

So one person said yup, and the other person said nope. ;-)

I agree it served to make the author look a bit foolish.

Re: SKS Keyserver Network Under Attack

#195

Post by dewyatt »

tptacek wrote: post #72
Sir_Cmpwn wrote: post #71

Earlier quoted context omitted.

I don't really see the link between the email you posted and efail, other than the fact that PGP encrypts the whole message. I don't understand how, if it encrypted smaller parts of the message, efail could have been avoided.

PGP has semi-optional, strippable authenticators. Serious cryptographic protocols do not. Plaintext encrypted with a modern AEAD cipher --- forget protocols, here we're just talking about selecting reasonable primitives --- can't be decrypted without simultaneously authenticating. That's not how PGP (or S/MIME) works, and that malleability led to Efail. No competent engineer would accept in 2019 (or, for that matter,…

The OpenPGP RFC bis does add AEAD. The spec is overall much too flexible IMO and could use some modernization, but I don't see it as un-salvageable, as you seem to.

Re: SKS Keyserver Network Under Attack

#196

Post by tptacek »

dewyatt wrote: post #195
tptacek wrote: post #72

Earlier quoted context omitted.

PGP has semi-optional, strippable authenticators. Serious cryptographic protocols do not. Plaintext encrypted with a modern AEAD cipher --- forget protocols, here we're just talking about selecting reasonable primitives --- can't be decrypted without simultaneously authenticating. That's not how PGP (or S/MIME) works, and that malleability led to Efail. No competent engineer would accept in 2019 (or, for that matter,…

The OpenPGP RFC bis does add AEAD. The spec is overall much too flexible IMO and could use some modernization, but I don't see it as un-salvageable, as you seem to.

OpenPGP is unsalvageable. One of the core goals of modern cryptography is to eliminate backwards compatibility with insecure 1990s crypto; OpenPGP instead lovingly preserves it.

Re: SKS Keyserver Network Under Attack

#197

Post by dewyatt »

tptacek wrote: post #196
dewyatt wrote: post #195

Earlier quoted context omitted.

The OpenPGP RFC bis does add AEAD. The spec is overall much too flexible IMO and could use some modernization, but I don't see it as un-salvageable, as you seem to.

OpenPGP is unsalvageable. One of the core goals of modern cryptography is to eliminate backwards compatibility with insecure 1990s crypto; OpenPGP instead lovingly preserves it.

Much of that could be solved by an implementation having user-controlled policies that whitelist/blacklist sets of algorithms. An implementation could be made with a sane default policy.

Of course, some things ought to just be replaced (S2K).

Post reply on HN