2

Digging through articles, one often finds recommendations such as "Use the default key type/size X", whereas an article written a few years later will write "Key type/size X has been found to be vulnerable; instead use the other key type Y".

Or one often comes across "make sure to change to stronger hash preferences" [example]. Other similar examples: PGP v3 keys vulnerable, Key IDs have serious problems.

Given the current state of information security and encryption what preferences or settings have been shown to be vulnerable, and should be avoided or replaced with stronger options?

  • If this question is too broad, it seems like a good candidate for a Community Wiki; I am not opposed to changing it to one. – IQAndreas Sep 21 '14 at 10:17
3

PGP Format Versions and Key IDs

Older versions of the PGP Key Format have several issues that potentially harm security. RFC 4880 further explains these, summarized very briefly:

  • higher chances for key ID collisions
  • fingerprint only hashes key, not size and algorithm (again, higher chance for ID collisions)
  • use of MD5, which is considered broken

Anyway, usage of short key IDs is considered bad practice, as chance of duplicate keys is rather high. Use long key IDs or the full fingerprint instead.

Asymmetric Encryption Algorithms

There are mainly three choices for choosing algorithms: DSA/Elgamal, RSA and elliptic curves (ECDSA).

I posted more on choosing keys in a Super User post.

Further Settings for Hashing and Symmetric Encryption

OpenPGP's and GnuPG's defaults do not meet highest possible security for compatibility reasons. You can change the preferred algorithms (you'd like others to use when encrypting to you) using a special signature. In GnuPG, you can create this using gpg --edit-key and updating the preferences using

setpref SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed

To change the preferences for signing and encrypting to others, add these lines to ~/.gnupg/gpg.conf:

personal-digest-preferences SHA256
cert-digest-algo SHA256
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed

These list has been put together by Ana Beatriz Guerrero López and order hashing algorithms, symmetric encryption algorithms and finally compression algorithms ordered by higher entropy/security.

Not an issues with keys, but somewhat related with those settings are two rather theoretical issues. Mister, Zuccherato proposed a decryption oracle attack on OpenPGP's cipher feedback mode, which can be mitigated by always compressing data that will be encrypted; and Jallad, Katz, Schneier proposed a chosen-ciphertext attack which can be prevented by using the newly introduced (in RFC 4880) Integrity Protected Data Packet (which is a choice made by the implementation).

  • 2
    Is there a reason Ana recommends SHA256 for the personal-digest-preferences and cert-digest-algo instead of the longer SHA512? Is it for compatibility reasons, performance reasons, or do the extra bytes have no impact on security? – IQAndreas Sep 21 '14 at 14:25
  • I am not aware of any compatibility problems (in the end, both are SHA-2 and have been defined together). It's probably just about performance and having reasonable sizes, same applies on choosing RSA 8096 or even larger keys (or not doing so). – Jens Erat Sep 21 '14 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.