Shea-Haller: LibrePGP not at risk

[Bruce Walzer]

On Tue, Sep 29, 2026 at 12:04:51PM -0400, Robert J. Hansen via Gnupg-users wrote:
> > As a working nerd who also deals with other uses of the RSA algorithm, it
> > would be nice to know which seasonings counteract this new poison and the
> > old results that it builds upon.
> 
> Basically, "don't use raw RSA". Using any sane kind of signature padding
> scheme, like PKCS#1-1.5 or RSA-PSS, foils the attack.

Or don't provide an attacker with an unlimited RSA signature oracle
and then withdraw access to the oracle later. In any sort of
imaginable PGP context, for example, that wouldn't even make
sense. Any bad stuff that the attacker might do could be done when the
oracle is available.

Bruce