Hello,
No, what he's saying is that if you can subvert the PGP software at a point
after it has both the secret key and the
passphrase and has combined them, you can get access to the files.
What he didn't said and wasn't explicit, was the possibility to decrypt the
files after he bypassed the authentication.
For me, it's implicit that the encryption key is the passphrase, that's what
makes sense, and that's PGP answer to this (you don't know the key, you
can't decrypt!).
What he did was bypassing the authentication phase, not the decryption.
My question was if the passphrase was used just for authentication layer,
and a fixed key was used for encryption (very very dumb possibility, but you
never know!). In his paper he says can see the files... Good. But it doesn't
say anything about retrieving those files. Well... He says if he uses a
debugger he can do that. I seriously doubt it. That doesn't make sense
because he never retrieved the encryption key, he just replaced it.
Unless he can demonstrate the decryption without the original key, this is
not that NASTY BIG bug that appears to be.
It's an important bug, because it compromises the content of the encrypted
disk due to the file listing possibility.
What's the validity of something like this in court ? Since the files are
still encrypted, it's not possible to create a checksum for those files and
compare with a known value.
Regards,
Pedro
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
