Security of PGP

The use of security programs does not guarantee that your communication is secure. Even if you install one of the safest locks on the front door, thieves can still crawl in through the open window. Also, even with PGP, your computer may still be vulnerable. There are many famous attacks on PGP, and the following sections describe these attacks. However, these are by no means a complete list. Future attacks are likely to compromise all public-key cryptography technologies. This checklist just gives you an idea of what you need to do to protect your communications. 1. The most direct attack on PGP by brute force attacks is the key used by brute force attacks. Because PGP 2.6.2 uses two encryption algorithms, look at the security of both algorithms. For public key cryptography, PGP uses the RSA algorithm, and for private key encryption, it uses idea. (1) Brute force attacks RSA keys for RSA keys, the best known brute force attack is to decompose them. RSA keys are generated so they are difficult to decompose. Moreover, the decomposition of large numbers is still a very new art. Most recently, the largest decomposed RSA key was RSA-129, which was decomposed in April 1994. RSA-129 is the original RSA question created in 1977 when designing the RSA algorithm. It is a 129-bit decimal RSA key, equivalent to 425 bits. The breakdown of this number mobilized worldwide power, using 1600 of computers, and actually takes more than 8 months. It deals with data for the 4600MIPS years; 1MIPS years is the amount of data that 1MIPS machines can handle in a year. For example, a Pentium 100 is about 125MIPS (according to Intel). If a Pentium 100 machine keeps running for a year to solve a problem, it contributes for 125MIPS years. At this rate, it takes 37 years for a machine to crack a RSA-129. If you use 100 machines, it only takes 4 months to decipher this code, just half the time of the actual project. Currently, the PGP 2.6.2 version uses keys from 512 to 2048 bits. The larger the key, the harder it is to decompose. Also, increasing the key length increases the time to use the key. From the date, it is thought that a 512-bit key can give 1 years of security; access to 100 Pentium 100 machines takes at least a year to decipher a 512-bit RSA key. If this is true, then a 1024-bit key, if used today's latest algorithm, assumes no technical improvement, and is safe for the next 10,000 years. If the technology improves, it will take less time. However, it seems that technology may have been progressing. (2) Brute force attack idea key I haven't heard of anyone attacking idea key. It is best to try 2^128 or 3.4x10^38 keys. Because of the difficulty of completing this test, it is easier to try to decipher the RSA key used to encrypt the idea key in PGP. It is estimated that the brokenThe difficulty of translating idea is similar to the difficulty of decomposing a 3,000-bit RSA key. --------------------------------------------------------------------------------2. The private key and security via the phrase PGP private key ring are based on two things: access to the private key loop data and an understanding of the phrase used to encrypt each private key. Use the private key to have both parts. However, this has also caused a lot of attacks. If PGP is used in a multiuser system, the private key ring may be accessed. By caching files, peering through a network, or many other attacks, you can use a monitoring network or read a disk to get the private key ring. This leaves only the use of phrases to protect the data in the private key ring, which means that the security of PGP can be breached as long as the phrase is obtained. Also, in a multiuser system, the link between the keyboard and the CPU may be unsafe. It is easy to monitor keystrokes if someone can physically access the network that connects the user's keyboard and host. For example, a user may log on from a group of public client terminals, and the connection network can be spied on by a phrase. In addition, the user may also unplug via a modem, in which case the thief can listen for keyboard keystrokes. In either case, it is unsafe to run PGP on a multi-user machine. Of course, the safest way to run PGP is to run on a personal machine that no one else is using and not connected to the net, that is, a laptop or a home computer. Users must find a balance between the cost of a secure environment and the cost of secure communications. The recommended method for using PGP is to always use a secure machine in a secure environment so that the user can control the entire machine. The best security key is that the connection between the keyboard and the CPU is secure. This can be done either through encryption or, better yet, through a direct, non-disruptive connection. Workstations, PCs, Macs, and laptops are safe machines. A secure environment is more difficult to show and is not discussed here. --------------------------------------------------------------------------------3. Attacks on public key loops because of the importance and dependence of public key ring (public keyring), PGP is attacked by many key rings. First, it is checked only when the key ring changes. When new keys or signatures are added, PGP validates them. However, it marks the signatures that have been checked in the key ring so that they are not validated. If someone modifies the key ring and sets the corresponding bit in the signature, it is not checked out. Another attack on PGP key loops focuses on the process used by PGP, which sets 1 bits for key validity. When a new signature of a key is reached, PGP computes the secret with the Trust network value described previouslyThe valid bit of the key. PGP then caches this significant bit in the public key ring. An attacker may modify this in the key ring, forcing the user to believe that an invalid key is valid. For example, by setting this flag, an attacker could allow the user to believe that a key belonged to Alice, although there was not enough signatures to prove the validity of the key. Another attack on PGP public key loops may occur because the key trust used as a reference is also cached in the public key ring. This value defines how much trust the key's signature has, so it is possible for PGP to accept the invalid key as a valid key if you use a key signature with an invalid parameter. If a key is modified to be a fully trusted reference, any key signed with this key is trusted to be valid. Therefore, an attacker who signs a modified key to another key will convince the user that it is valid. The biggest problem with public key loops is that all of these bits are not only cached in the public key ring, but there is no protection in the key ring. Anyone who has read PGP source code and has access to the public key ring can use a binary file editor to modify any one, and the owner of the key ring cannot notice the change. Fortunately, PGP provides a way to re-examine the keys in the key ring. By combining the-KC and-km options, the user can tell PGP to perform key maintenance on the entire key ring. The previous option tells PGP to check the key and signature. PGP looks at the entire key ring and checks each signature again. When all signatures are checked, PGP performs a maintenance check (-KM) to recalculate the validity of all keys. Unfortunately, there is no way to completely re-examine all the trust bytes in the key. This is a loophole. There should be a command telling PGP to ignore all the trusted bytes and ask the user for trust from the ultimate key, the key in the private key ring. Perhaps the future version of PGP will correct the problem. If a key is changed to be a trusted reference, you have no way to find the change and correct it. Running keys and maintenance checks can only restore the validity of the key, but not the trust value. You cannot edit trust parameters until you run Pgp-ke on one key, which cannot be done automatically. --------------------------------------------------------------------------------4. Security of the program if someone can access the binary file of the PGP program, He can change it and let it do whatever he wants. If the intervening person can replace your PGP binaries from under your nose, your trust in PGP is based on your trust in this person and your ability to actually verify the program. For example, an attacker who was able to make such a visit could change PGP so that it always verifies the signature, or even the signature is invalid. PGP may be modified to always send all the NSAThe plain text copy. These attacks are difficult to detect and difficult to deal with. PGP needs to be part of the fiduciary code base, and if you don't trust your PGP binaries, don't trust its output. The best way to believe in PGP binaries is to build it from your source code. However, this is not always possible. Other options include monitoring it when it is established or getting it from a trusted source. It is helpful to view the size and date of a binary file. Using other fiduciary procedures like md5sum can help. But it just puts the problem on the other level. If you don't trust the PGP program, there's not much to do. --------------------------------------------------------------------------------5. Other attacks on PGP may have other attacks on PGP, But there is no discussion here. The encryption algorithm used by PGP has never been proven to be secure. The mathematics used by PGP, although considered safe, can be easily compromised. The decomposition attack on RSA may be improved, or someone may find a vulnerability in idea. To know what security, what is not safe, the use of cryptography technology to understand the mathematical knowledge is not enough. In fact, it is understood that nothing is completely safe, and that any form of cryptography can be compromised if there is sufficient computational power. The question is whether the time and effort spent deciphering the code is worth comparing the value of the data being protected. Note that the power spent deciphering the code will decrease over time as the computer's capabilities continue to increase and prices continue to fall. Until now, password experts are still ahead of the deciphering. To force (0 Votes) Tempted (0 Votes) nonsense (0 Votes) Professional (0 Votes) title Party (0 Votes) passing (0 Votes) Text: PGP Security return to network security home