Which PGP settings have been found to be vulnerable?

Question

Digging through articles, one often finds recommendations such as "Use the default key type/size X", whereas an article written a few years later will write "Key type/size X has been found to be vulnerable; instead use the other key type Y".

Or one often comes across "make sure to change to stronger hash preferences" [example]. Other similar examples: PGP v3 keys vulnerable, Key IDs have serious problems.

Given the current state of information security and encryption what preferences or settings have been shown to be vulnerable, and should be avoided or replaced with stronger options?

Answer 1

PGP Format Versions and Key IDs

Older versions of the PGP Key Format have several issues that potentially harm security. RFC 4880 further explains these, summarized very briefly:

• higher chances for key ID collisions
• fingerprint only hashes key, not size and algorithm (again, higher chance for ID collisions)
• use of MD5, which is considered broken

Anyway, usage of short key IDs is considered bad practice, as chance of duplicate keys is rather high. Use long key IDs or the full fingerprint instead.

Asymmetric Encryption Algorithms

There are mainly three choices for choosing algorithms: DSA/Elgamal, RSA and elliptic curves (ECDSA).

• DSA is very dependent from good random numbers during key generation and usage of the key. As there have been several issues with random number generators, it isn recommended as default algorithm any more ([1], [2], more on Wikipedia), although smaller keys are sufficient (compared with RSA).
• RSA needs larger key sizes, but is considered secure for adequately large keys. 768 bit keys have been broken, 1024 bit keys might be. Keys starting from 2048 bits are considered safe and currently are default, keys of 4096 bits currently recommended by Debian and others.
• Ellipctic Curves aren't broadly supported yet (GnuPG 2.1 will bring them, Google's End to End already uses them), and the security of the NIST-selected curves is still in doubt (without any proof). Generally, elliptic curves are considered safe.

I posted more on choosing keys in a Super User post.

Further Settings for Hashing and Symmetric Encryption

OpenPGP's and GnuPG's defaults do not meet highest possible security for compatibility reasons. You can change the preferred algorithms (you'd like others to use when encrypting to you) using a special signature. In GnuPG, you can create this using gpg --edit-key and updating the preferences using

setpref SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed

To change the preferences for signing and encrypting to others, add these lines to ~/.gnupg/gpg.conf:

personal-digest-preferences SHA256
cert-digest-algo SHA256
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed

These list has been put together by Ana Beatriz Guerrero López and order hashing algorithms, symmetric encryption algorithms and finally compression algorithms ordered by higher entropy/security.

Not an issues with keys, but somewhat related with those settings are two rather theoretical issues. Mister, Zuccherato proposed a decryption oracle attack on OpenPGP's cipher feedback mode, which can be mitigated by always compressing data that will be encrypted; and Jallad, Katz, Schneier proposed a chosen-ciphertext attack which can be prevented by using the newly introduced (in RFC 4880) Integrity Protected Data Packet (which is a choice made by the implementation).