For the sake of this question, assume that I am security conscious to the point of paranoid.
I am concerned that older versions of GnuPG may be compromised due to RSA encryption keys because of known attacks on RSA before. I have done some research and I have listed my research down below.
- In August 2007, Dan Shumow and Niels Ferguson of Microsoft showed that the constants could be constructed in such a way as to create a kleptographic backdoor in the algorithm.
- In 2013, Reuters reported that documents released by Edward Snowden indicated that the NSA had paid RSA Security $10 million to make Dual_EC_DRBG the default in their encryption software, and raised further concerns that the algorithm might contain a backdoor for the NSA.
Doing one exploit or attack may not be enough so the NSA will have to use multiple exploits at once.
- By using zero days in web browsers to execute complex arbitrary code to install kleptographic random number generators without the owner realizing the attack.
- After NSA has installed the backdoor, the victim's internet pattern is recorded and analyzed by a remote complex system that knows when the user will communicate with other contacts which by then snatches the encrypted information that has been encrypted with the encryption key that was generated by the kleptographic R.N.G. and immediately sends the decrypted information to a remote location where it can be read.
- The NSA circumvented encryption such as SSL and RSA. What I found interesting was that the NSA may have been planting backdoors in random number generators with a special algorithm that can automatically decrypt encrypted messages. The goal is to not fight the encryption head on because the NSA doesn't have the resources or time to do so, but to fight the encryption asymmetrically. They do this by exploiting weaknesses in encryption programs such as the heartbleed bug before it was even known the NSA has been (allegedly) hiring top cryptanalysts and hackers to find bugs in software that can be exploited with a zero day that only the NSA knows to circumvent encryption.
If we assume that the NSA will perform the above attacks, what countermeasures could I use to protect myself?