Bugtraq mailing list archives
Re: A Nasty Security Bug that affect PGP Virtual Disks & PGP SDA , PGP 8.x & 9.x and Truecrypt.
From: 3APA3A <3APA3A () SECURITY NNOV RU>
Date: Fri, 26 May 2006 19:46:56 +0400
Dear thesinoda () hotmail com, Sorry, but I see no security vulnerability here. Disk encryption usually works this way: 1. Disk is divided to blocks (or files). Each block is encrypted with random symmetric key to extend security and encryption/description speed. 2. Block key is encrypted with user's public key (or sometimes symmetric key) 3. User's private key (or shared symmetric key) is encrypted with passphrase and is used for decryption. If you change passphrase, you decrypt your key and encrypt it with news one. Key itself is not changed, because if key is changed you will not be able to decrypt files. Then you give your disk with passphrase to someone - you actually share your private key. This is the point YOU break security (or person who accepts your key as his own). Now, you both share same key, and changing passphrase to encrypt this key doesn't help. Actually, what you do with cut-and-paster is restoring your key encrypted with old passphrase. It's expected behaviour. --Thursday, May 25, 2006, 12:55:35 AM, you wrote to bugtraq () securityfocus com: thc> * After changing the passphrase the OLD passphrase SHOULD NOT work. thc> * Open pgpdisk.pgd and pgpdisk_backup.pgd in HEX editor thc> e.g Ultraedit ONLY CHANGE WHERE YOU SEE A RED RECTANGULAR. ... thc> * Do some copy and past from the back-up file into pgpdisk.pgd -- ~/ZARAZA http://www.security.nnov.ru/
Current thread:
- A Nasty Security Bug that affect PGP Virtual Disks & PGP SDA , PGP 8.x & 9.x and Truecrypt. thesinoda (May 25)
- Re: A Nasty Security Bug that affect PGP Virtual Disks & PGP SDA , PGP 8.x & 9.x and Truecrypt. 3APA3A (May 26)
- Re: A Nasty Security Bug that affect PGP Virtual Disks & PGP SDA , PGP 8.x & 9.x and Truecrypt. Alexander Klimov (May 26)
- RE: [security] A Nasty Security Bug that affect PGP Virtual Disks & PGP SDA , PGP 8.x & 9.x and Truecrypt. phugo (May 27)
- <Possible follow-ups>
- RE: A Nasty Security Bug that affect PGP Virtual Disks & PGP SDA , PGP 8.x & 9.x and Truecrypt. ennead () truecrypt org (May 26)
- Re: RE: A Nasty Security Bug that affect PGP Virtual Disks & PGP SDA , PGP 8.x & 9.x and Truecrypt. ahariri (May 26)
- RE: A Nasty Security Bug that affect PGP Virtual Disks & PGP SDA , PGP 8.x & 9.x and Truecrypt. thesinoda (May 27)
- Re: Re: A Nasty Security Bug that affect PGP Virtual Disks & PGP SDA , PGP 8.x & 9.x and Truecrypt. visitbipin (May 27)