Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SKS Keyserver Network Under Attack

gist.github.com

Post reply on HN
Print view View original

171–180 of 197 posts

Re: SKS Keyserver Network Under Attack

#171

Post by mirimir »

tptacek wrote: post #100
diafygi wrote: post #99

Earlier quoted context omitted.

> This isn't the first time the GnuPG ecosystem has responded this way to attacks. Hmmmm, I think this is a bit of squeaky wheel situation going on. Remember that the sks keyserver pool is mostly a decentralized group of volunteers running a server as a hobby. So you can have all types of people operating keyservers in the pool. For instance, I've been running a keyserver in the pool for several years. However, I don…

The fact that it is simultaneously a "hobby" and an "attempt to help activists communicate securely" is emblematic of the whole problem here. Either way, the time for Hansen to have warned people about the keyservers was when he first became aware of the vulnerability ("well over a decade" ago), not right after it got exploited on him personally . Everything about this response, from the personal offense he's taken t…

I'm certainly no crypto expert. And, sad to admit, I hadn't even heard of trollwot until today. Or keyserver-fs or sks-exploit. I have read about risks of key collision, but had the impression that faked keys wouldn't actually work.

So yes, I get the argument that Hansen should have warned people. But I gotta wonder who else has been aware of this vulnerability for years.

And I wonder how bad this could get. I can purge requests to SKS keyservers from my machines, but what about all the upstream impacts? As I understand it, GnuPG authentication is pervasive. And "ask SKS" may be almost as pervasive.

Re: SKS Keyserver Network Under Attack

#172

Post by jeduardo »

KirinDave wrote: post #155
mycall wrote: post #134

Earlier quoted context omitted.

[matrix] and Riot.im are alternatives to Signal and Wire.

Unfortunately these have strong privacy implications as they all phone home an awful lot.

Do you have more info about this? As far as I understand if you use e2e encryption with riot/matrix you should be quite safe.

Re: SKS Keyserver Network Under Attack

#173

Post by lifeisstillgood »

danShumway wrote: post #142
lifeisstillgood wrote: post #138

My attempt to understand this - please correct liberally Things I know today that I did not know yesterday - The GnuPG (GPG) ecosystem seems to suffer from pre-heart bleed-OpenSSL levels of not enough investment and people - The GPG ecosystem has a trivial DOS attack that can be mounted against it, with bad actors able to append thousands of keys to any users "account" effectively making it impossible to read that ac…

This roughly aligns with my understanding as well. The additional takeaways I'd add (that may or may not be accurate): - Many security researchers disagree with the core idea of SKS servers in general (they're essentially just undeletable online storage that anyone can write to). The distributed "Web of Trust" model itself is considered untrustworthy. - The vulnerability is triggered by the usage of the SKS servers.…

Agreed - It would be nice to understand the dependency chain for SKS servers

And Inwoukd also like to understand what people mean by "get rid of GPG/PGP?" - it cannot mean get rid of keypairs, so it is just replace with some "nicer" code? what is the problem?

Re: SKS Keyserver Network Under Attack

#174

Post by [deleted] »

snazz wrote: post #51
snackematician wrote: post #31

Earlier quoted context omitted.

Sibling comments have discussed how this affects Debian, Ubuntu, and opensuse -- any Arch users know how this affects us? Seems like official repos should be fine but what about packages from the AUR?

I don’t think the AUR has a concept of package signing—a PKGBULD will often download a tarball from somewhere and any signing is ad-hoc. The official repositories use their own key ring (which is distributed without a key server).

[deleted]

Re: SKS Keyserver Network Under Attack

#175

Post by chakalakasp »

danShumway wrote: post #136
tptacek wrote: post #117

Earlier quoted context omitted.

You asked (among other things) how to send messages securely without PGP. Don't use PGP to send secure messages; use a secure messenger, like Signal or Wire. Someone else asked how to email securely without PGP. Email isn't secure with PGP. Don't use PGP to send encrypt emails, and don't use email to send secure messages; use a secure messenger, like Signal or Wire. I acknowledge there are use cases not well covered…

To be clear, I'm not saying that anyone who criticizes PGP needs an easy solution. I agree with all the stuff I'm seeing in this thread, and I get that the current answer might be, "well, the ecosystem is kind of bad right now." But what I'm getting at is that it's one thing to understand that the ecosystem is bad, but that on its own is not information I (or most people) are equipped to act on. Minisign could solve…

If you need to encrypt files (symmetrically) then use a tool that does this well like Veracrypt.

Re: SKS Keyserver Network Under Attack

#176

Post by Arathorn »

jeduardo wrote: post #172
KirinDave wrote: post #155

Earlier quoted context omitted.

Unfortunately these have strong privacy implications as they all phone home an awful lot.

Do you have more info about this? As far as I understand if you use e2e encryption with riot/matrix you should be quite safe.

I imagine the GP is talking about https://news.ycombinator.com/item?id=20178267. We've spent the last few weeks going through fixing the issues which this highlighted; there'll be a blog post later today (or tomorrow) giving an update on how we've addressed the points in question.

Re: SKS Keyserver Network Under Attack

#177

Post by malaxii »

mirimir wrote: post #160
lifeisstillgood wrote: post #138

My attempt to understand this - please correct liberally Things I know today that I did not know yesterday - The GnuPG (GPG) ecosystem seems to suffer from pre-heart bleed-OpenSSL levels of not enough investment and people - The GPG ecosystem has a trivial DOS attack that can be mounted against it, with bad actors able to append thousands of keys to any users "account" effectively making it impossible to read that ac…

> - This may or may not mean that major distributions binary packages will simply stop being verifiable - it depends on who uses what key server in what chain of trust. We probably won't find out till more bad actors poison more wells Debian keys come from keyring.debian.org, so ??? I'm guessing that chains of trust from there go through the SKS keyservers. If that's so, Debian updates will likely be hosed at some po…

Wrong:

Debian installations come with preinstalled keyring with the archive signing keys. Upgrades to that keyring are provided via packages, which are signed with the previous archive key. The same for Fedora and rpm. Public keyservers or web of trust are not involved.

On the internet you can obviously find all sorts of bad guides written by random people.

Re: SKS Keyserver Network Under Attack

#178

Post by malaxii »

lifeisstillgood wrote: post #138

My attempt to understand this - please correct liberally Things I know today that I did not know yesterday - The GnuPG (GPG) ecosystem seems to suffer from pre-heart bleed-OpenSSL levels of not enough investment and people - The GPG ecosystem has a trivial DOS attack that can be mounted against it, with bad actors able to append thousands of keys to any users "account" effectively making it impossible to read that ac…

> - This may or may not mean that major distributions binary packages will simply stop being verifiable - it depends on who uses what key server in what chain of trust. We probably won't find out till more bad actors poison more wells

All distributions I know use a pre-shared keyring for package signing, distributed on the initial installation media. Public keyservers are not involved.

This is unaffected by any issues with web-of-trust and public keyservers.

Re: SKS Keyserver Network Under Attack

#179

Post by the_why_of_y »

Shoop wrote: post #5

> It's written in an unusual programming language called OCaml, and in a fairly idiosyncratic dialect of it at that. This is of course no problem for a proof of concept meant to support a Ph.D thesis, but for software that's deployed in the field it makes maintenance quite difficult. Not only do we need to be bright enough to understand an algorithm that's literally someone's Ph.D thesis, but we need expertise in obs…

Also according to TFA, the server apparently can cope with these pathological keys just fine, it's the GnuPG client, "production" code implemented in C, that falls over dead after it has downloaded the key from a server. Which leaves me puzzled why the server needs bashing.

Re: SKS Keyserver Network Under Attack

#180

Post by AnaniasAnanas »

the_why_of_y wrote: post #179
Shoop wrote: post #5

> It's written in an unusual programming language called OCaml, and in a fairly idiosyncratic dialect of it at that. This is of course no problem for a proof of concept meant to support a Ph.D thesis, but for software that's deployed in the field it makes maintenance quite difficult. Not only do we need to be bright enough to understand an algorithm that's literally someone's Ph.D thesis, but we need expertise in obs…

Also according to TFA, the server apparently can cope with these pathological keys just fine, it's the GnuPG client, "production" code implemented in C, that falls over dead after it has downloaded the key from a server. Which leaves me puzzled why the server needs bashing.

It's even worse than it seems. The certificates are only a few megabytes long. https://twitter.com/FiloSottile/status/1145091106138394625
Post reply on HN