what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 4 of 4

Files from Werner Koch

Libgcrypt 1.5.0

Posted Nov 12, 2012

Authored by Werner Koch | Site gnu.org

Libgcrypt is a general-purpose cryptographic library based on the code from GnuPG. It provides functions for all cryptographic building blocks: symmetric ciphers (AES, DES, Blowfish, CAST5, Twofish, and Arcfour), hash algorithms (MD4, MD5, RIPE-MD160, SHA-1, and TIGER-192), MACs (HMAC for all hash algorithms), public key algorithms (RSA, ElGamal, and DSA), large integer functions, random numbers, and a lot of supporting functions.

Changes: This release added a new gcry_kdf_derive function implementing OpenPGP S2K algorithms and PBKDF2, support for Windows CE, support for ECDH, OAEP, and PSS methods (RFC 3447), new "%M" and "%u" format specifiers for gcry_sexp_build, and new functions that map ECC parameters to a curve name and parameter values. gcry_mpi_cmp when applied to opaque values now has a defined semantic. Intel AES-NI instructions are used if available. The module register subsystem has been deprecated. CTR mode may now be used with data chunks of arbitrary length. PKCS v1.5 code was fixed to always return the leading zero.

tags | library

systems | unix

SHA-256 | cc98b1f64c9ae3b0185099cef4ac6c436a849095edf87f34157f0bb10e187990

Download | Favorite | View

gpgtaketwo.txt

Posted Dec 1, 2006

Authored by Werner Koch

While fixing a bug reported by Hugh Warrington, a buffer overflow has been identified in all released GnuPG versions. The current versions 1.4.5 and 2.0.0 are affected. A small patch is provided.

tags | advisory, overflow

SHA-256 | 16c01b2238c245fb4f9fc03e97f5aeb254dee53057a1c155fb1859213957cf2b

Download | Favorite | View

gnupgDetect.txt

Posted Mar 11, 2006

Authored by Werner Koch | Site gnupg.org

All versions of gnupg prior to 1.4.2.2 do not detect injection of unsigned data. Signature verification of non-detached signatures may give a positive result but when extracting the signed data, this data may be prepended or appended with extra data not covered by the signature. Thus it is possible for an attacker to take any signed message and inject extra arbitrary data.

tags | advisory, arbitrary

advisories | CVE-2006-0049

SHA-256 | 33664dce746ce85ae7b0b0afb061d573e59b19d74f2b21ee3bfea0498ba07b5e

Download | Favorite | View

000276.html

Posted Dec 1, 2003

Authored by Werner Koch | Site lists.gnupg.org

Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys for signing. This is a significant security failure which can lead to a compromise of almost all ElGamal keys used for signing. Note that this is a real world vulnerability which will reveal your private key within a few seconds.

tags | advisory

SHA-256 | 85e50ed51bad2ccd298b77d5a8b7daf4ef35336d896cce52b84c4db05a6c0ba2

Download | Favorite | View