[Announce] Security fixes for Libgcrypt and GnuPG 1.4 [CVE-2016-6316]

Werner Koch wk at gnupg.org
Wed Aug 17 18:06:56 CEST 2016 

Hello!

The GnuPG Project is pleased to announce the availability of new
Libgcrypt and GnuPG versions to *fix a critical security problem*.

Felix Dörre and Vladimir Klebanov from the Karlsruhe Institute of
Technology found a bug in the mixing functions of Libgcrypt's random
number generator: An attacker who obtains 4640 bits from the RNG can
trivially predict the next 160 bits of output.  This bug exists since
1998 in all GnuPG and Libgcrypt versions.


Impact
======
All Libgcrypt and GnuPG versions released before 2016-08-17 are affected
on all platforms.

A first analysis on the impact of this bug in GnuPG shows that existing
RSA keys are not weakened.  For DSA and Elgamal keys it is also unlikely
that the private key can be predicted from other public information.
This needs more research and I would suggest _not to_ overhasty revoke
keys.


Solution
========
If you are using a vendor supplied version of GnuPG or Libgcrypt:

 * Wait for an update from your vendor.

If you are using a GnuPG-2 version (2.0.x or 2.1.x):

 * Update Libgcrypt.  We have released these fixed versions of
   Libgcrypt: 1.7.3, 1.6.6, and 1.5.6.  See below for download
   information.

If you are using GnuPG-1 version (1.4.x): 

 * Update as soon as possible to GnuPG 1.4.21.  See below for download
   information.
     
   
Support
=======
For help on developing with GnuPG or Libgcrypt you should read the
included manuals and ask on the appropriate mailing list [1,2].  A
listing with commercial support offers for GnuPG and Libgcrypt and
related software is available at the GnuPG web site [3].

Maintenance and development of GnuPG and Libgcrypt is mostly financed by
donations; see <https://gnupg.org/donate/>.  We need your donations to
continue our work.


Thanks
======
We like to thank all the people who helped with this release, be it
testing, coding, translating, suggesting, auditing, administering the
servers, spreading the word, and answering questions on the mailing
lists.  Thanks to Felix Dörre and Vladimir Klebanov for sending us a
draft of their research paper and working with us on a solution.  Also
many thanks to all our donors [4].


Download
========
Source code is hosted at the GnuPG FTP server and its mirrors as listed
at <https://gnupg.org/download/mirrors.html>.  On the primary server the
source tarballs and their digital signature are:

 ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-1.7.3.tar.bz2
 ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-1.7.3.tar.bz2.sig

 ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-1.6.6.tar.bz2
 ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-1.6.6.tar.bz2.sig

 ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-1.5.6.tar.bz2
 ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-1.5.6.tar.bz2.sig

 ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.21.tar.bz2
 ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.21.tar.bz2.sig

These files are also available via HTTP:

 https://gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-1.7.3.tar.bz2 
 https://gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-1.7.3.tar.bz2.sig

 https://gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-1.6.6.tar.bz2    
 https://gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-1.6.6.tar.bz2.sig

 https://gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-1.5.6.tar.bz2    
 https://gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-1.5.6.tar.bz2.sig

 https://gnupg.org/ftp/gcrypt/gnupg/gnupg-1.4.21.tar.bz2    
 https://gnupg.org/ftp/gcrypt/gnupg/gnupg-1.4.21.tar.bz2.sig


Checking the Integrity
======================
In order to check that the version you downloaded is an original
and unmodified file please follow the instructions found at
<https://gnupg.org/download/integrity_check.html>.  In short, you may
use one of the following methods:

 - Check the supplied OpenPGP signature.  For example to check the
   signature of the file libgcrypt-1.7.4.tar.bz2 you would use this
   command:

     gpg --verify libgcrypt-1.7.4.tar.bz2.sig libgcrypt-1.7.4.tar.bz2

   This checks whether the signature file matches the source file.  You
   should see a message indicating that the signature is good and made
   by one or more of the release signing keys. 

 - If you are not able to use GnuPG, you have to verify the SHA-1
   checksum.  For example:

     sha1sum libgcrypt-1.7.3.tar.bz2

   and check that the output matches the first line from the
   this list:

5a034291e7248592605db448481478e6c963aa9c  libgcrypt-1.7.3.tar.bz2
a05cba7037e6cbc68dcf3ea5b45f703b79fa234f  libgcrypt-1.7.3.tar.gz
ad79fd0b6963e1049612aa5d98e1a0b8eb775701  libgcrypt-1.6.6.tar.bz2
d11b6ca1d55eb12f5d3091a5169d874806007130  libgcrypt-1.6.6.tar.gz
62eade7cd3545efee1a87512d54f69151abbae47  libgcrypt-1.5.6.tar.bz2
8d3f55cce21e17f21d0c991cccf6bf52ec244353  libgcrypt-1.5.6.tar.gz
e3bdb585026f752ae91360f45c28e76e4a15d338  gnupg-1.4.21.tar.bz2
97bfba0e4db7cb1a3458f73240481767cb7fe90e  gnupg-1.4.21.tar.gz

   You should also verify that the checksums above are authentic by
   matching them with copies of this announcement.  Those copies can be
   found at other mailing lists, web sites, and search engines.


Release Signing Keys
====================
To guarantee that a downloaded GnuPG version has not been tampered by
malicious entities we provide signature files for all tarballs and
binary versions.  The keys are also signed by the long term keys of
their respective owners.  Current releases are signed by one or more
of these four keys:

  2048R/4F25E3B6 2011-01-12 [expires: 2019-12-31]
  Key fingerprint = D869 2123 C406 5DEA 5E0F  3AB5 249B 39D2 4F25 E3B6
  Werner Koch (dist sig)

  rsa2048/E0856959 2014-10-29 [expires: 2019-12-31]
  Key fingerprint = 46CC 7308 65BB 5C78 EBAB  ADCF 0437 6F3E E085 6959
  David Shaw (GnuPG Release Signing Key) <dshaw 'at' jabberwocky.com>

  rsa2048/33BD3F06 2014-10-29 [expires: 2016-10-28]
  Key fingerprint = 031E C253 6E58 0D8E A286  A9F2 2071 B08A 33BD 3F06
  NIIBE Yutaka (GnuPG Release Key) <gniibe 'at' fsij.org>

  rsa2048/7EFD60D9 2014-10-19 [expires: 2020-12-31]
  Key fingerprint = D238 EA65 D64C 67ED 4C30  73F2 8A86 1B1C 7EFD 60D9
  Werner Koch (Release Signing Key)

You may retrieve these keys from a keyserver using this command

  gpg --keyserver hkp://keys.gnupg.net --recv-keys  \
                  249B39D24F25E3B6 04376F3EE0856959 \
                  2071B08A33BD3F06 8A861B1C7EFD60D9

The keys are also available at https://gnupg.org/signature_key.html and
in any recently released GnuPG tarball in the file g10/distsigkey.gpg .
Note that this mail has been signed by a different key.


For the GnuPG hackers,

   Werner


p.s.
This is an announcement only mailing list.  Please send replies only to
the gnupg-users 'at' gnupg.org mailing list.


[1] https://lists.gnupg.org/mailman/listinfo/gnupg-devel
[2] https://lists.gnupg.org/mailman/listinfo/gcrypt-devel
[3] https://www.gnupg.org/service.html
[4] https://gnupg.org/donate/kudos.html

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.
 /* Join us at OpenPGP.conf  <https://openpgp-conf.org> */
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 162 bytes
Desc: not available
URL: </pipermail/attachments/20160817/9a9f4612/attachment-0001.sig>
-------------- next part --------------
_______________________________________________
Gnupg-announce mailing list
Gnupg-announce at gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-announce

More information about the Gnupg-devel mailing list