CVE-2021-40528

The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Libgcrypt is a general purpose cryptographic library originally based on code from GnuPG.

Security Fix(es):

The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.(CVE-2021-40528)

The libgcrypt library provides general-purpose implementations of various cryptographic algorithms.

Security Fix(es):

• libgcrypt: ElGamal implementation allows plaintext recovery (CVE-2021-40528)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fix(es):

• libgcrypt: ElGamal implementation allows plaintext recovery (CVE-2021-40528) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2013-4576: Normalize the MPIs to prevent possible side-channel attacks
• CVE-2014-3591: Use ciphertext blinding for Elgamal to prevent possible side-channel attacks
• CVE-2021-33560: Use of smaller K for ephemeral key in ElGamal prevent generation of weak keys
• CVE-2021-40528: Add exponent blinding as well to mitigate side-channel attack on mpi_powm
• tests: Add a benchmark for Elgamal

• CVE-2013-4576: Normalize the MPIs to prevent possible side-channel attacks
• CVE-2014-3591: Use ciphertext blinding for Elgamal to prevent possible side-channel attacks
• CVE-2021-33560: Use of smaller K for ephemeral key in ElGamal prevent generation of weak keys
• CVE-2021-40528: Add exponent blinding as well to mitigate side-channel attack on mpi_powm
• tests: Add a benchmark for Elgamal

The updated packages fix a security vulnerability:

The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP (CVE-2021-40528).

These are all security issues fixed in the libgcrypt-devel-1.10.1-1.1 package on the GA media of openSUSE Tumbleweed.

It was discovered that Libgcrypt incorrectly handled ElGamal encryption. An attacker could possibly use this issue to recover sensitive information.

USN-5080-1 fixed several vulnerabilities in Libgcrypt. This update provides the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that Libgcrypt incorrectly handled ElGamal encryption. An attacker could possibly use this issue to recover sensitive information.