CVE-2014-3591

Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.

Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.

• CVE-2013-4576: Normalize the MPIs to prevent possible side-channel attacks
• CVE-2014-3591: Use ciphertext blinding for Elgamal to prevent possible side-channel attacks
• CVE-2021-33560: Use of smaller K for ephemeral key in ElGamal prevent generation of weak keys
• CVE-2021-40528: Add exponent blinding as well to mitigate side-channel attack on mpi_powm
• tests: Add a benchmark for Elgamal

• CVE-2013-4576: Normalize the MPIs to prevent possible side-channel attacks
• CVE-2014-3591: Use ciphertext blinding for Elgamal to prevent possible side-channel attacks
• CVE-2021-33560: Use of smaller K for ephemeral key in ElGamal prevent generation of weak keys
• CVE-2021-40528: Add exponent blinding as well to mitigate side-channel attack on mpi_powm
• tests: Add a benchmark for Elgamal

GnuPG before 1.4.19 is vulnerable to a side-channel attack which can potentially lead to an information leak (CVE-2014-3591).

GnuPG before 1.4.19 is vulnerable to a side-channel attack on data-dependent timing variations in modular exponentiation, which can potentially lead to an information leak (CVE-2015-0837).

The gnupg package has been patched to correct these issues.

GnuPG2 is vulnerable to these issues through the libgcrypt library. The issues were fixed in libgcrypt 1.6.3. The libgcrypt package in Mageia, at version 1.5.4, was only vulnerable to the CVE-2014-3591 issue. It has also been patched to correct this issue.

These are all security issues fixed in the libgcrypt-cavs-1.7.3-1.3 package on the GA media of openSUSE Tumbleweed.

This update of libgcrypt fixes one security issue and brings various FIPS 140-2 related improvements.

libgcrypt now uses ciphertext blinding for Elgamal decryption (CVE-2014-3591)

FIPS 140-2 related changes:

• The library performs its self-tests when the module is complete (the -hmac file is also installed).

• Added a NIST 800-90a compliant DRBG.

• Change DSA key generation to be FIPS 186-4 compliant.

• Change RSA key generation to be FIPS 186-4 compliant.

• Enable HW support in fips mode (bnc#896435)

• Make DSA selftest use 2048 bit keys (bnc#898003)

• Added ECDSA selftests and add support for it to the CAVS testing framework (bnc#896202)

• Various CAVS testing improvements.

This update fixes the following issues:

• Use ciphertext blinding for Elgamal decryption [CVE-2014-3591]. See http://www.cs.tau.ac.il/~tromer/radioexp/ for details. (bsc#920057)
• Fixed data-dependent timing variations in modular exponentiation [related to CVE-2015-0837, Last-Level Cache Side-Channel Attacks are Practical]

Daniel Genkin, Lev Pachmanov, Itamar Pipman, and Eran Tromer discovered that GnuPG was susceptible to an attack via physical side channels. A local attacker could use this attack to possibly recover private keys. (CVE-2014-3591)

Daniel Genkin, Adi Shamir, and Eran Tromer discovered that GnuPG was susceptible to an attack via physical side channels. A local attacker could use this attack to possibly recover private keys. (CVE-2015-0837)

Hanno Böck discovered that GnuPG incorrectly handled certain malformed keyrings. If a user or automated system were tricked into opening a malformed keyring, a remote attacker could use this issue to cause GnuPG to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-1606, CVE-2015-1607)

In addition, this update improves GnuPG security by validating that the keys returned by keyservers match those requested.

Daniel Genkin, Lev Pachmanov, Itamar Pipman, and Eran Tromer discovered that Libgcrypt was susceptible to an attack via physical side channels. A local attacker could use this attack to possibly recover private keys. (CVE-2014-3591)

Daniel Genkin, Adi Shamir, and Eran Tromer discovered that Libgcrypt was susceptible to an attack via physical side channels. A local attacker could use this attack to possibly recover private keys. (CVE-2015-0837)