AUSCERT External Security Bulletin Redistribution
                  ESB-2000.111 -- CERT Advisory CA-2000-09
                       Flaw in PGP 5.0 Key Generation
                                 31 May 2000


	AusCERT Security Bulletin Summary

Product:		PGP 5.0
Vendor:			PGP
Operating System:	Unix
Platform:		N/A

Impact:			Access Confidential Data
                        Provide Misleading Information
Access Required:	Remote, Local

- --------------------------BEGIN INCLUDED TEXT--------------------

Hash: SHA1

CERT Advisory CA-2000-09 Flaw in PGP 5.0 Key Generation

   Original release date: May 30, 2000
   Last Revised: --
   Source: CERT/CC
   A complete revision history is at the end of this file.
Systems Affected

     * UNIX systems having a /dev/random device running any version of
       PGP 5.0, including U.S. Commercial, U.S. Freeware, and
       International versions
     * Keys created non-interactively on such a system
     * Documents encrypted with such a key
     * Signatures generated with such a key

   Under certain circumstances, PGP v5.0 generates keys that are not
   sufficiently random, which may allow an attacker to predict keys and,
   hence, recover information encrypted with that key.
I. Description

   In order to generate cryptographically secure keys, PGP (and other
   products) need to use random numbers as part of the input to the key
   generation process. Generating truly random numbers is a difficult
   problem. PGP has traditionally solved that problem by prompting the
   user to type some random characters or to move the mouse in a random
   manner, measuring the time between keystrokes and using this as a
   source of random data. Additionally, PGP uses a file (usually called
   randseed.bin) as a source of randomness. However, PGP also provides
   the ability to generate keys non-interactively (useful, for example,
   if you need to generate a large number of keys simultaneously or
   provide a script to generate a key). When generating keys
   non-interactively, PGP needs a source of random numbers; on some
   systems PGP v5.0 uses the /dev/random device to provide the required
   random numbers.
   PGP v5.0, including U.S. Commercial, U.S. Freeware, and International
   versions, contains a flaw in reading the information provided by
   /dev/random. This is not a flaw in /dev/random but instead is the
   result of a flaw in how PGP processes the information returned from
   /dev/random. Thus, when a key is generated non-interactively using a
   command such as
   pgpk -g <DSS or RSA> <key-length> <user-id> <timeout> <pass-phrase>
   it does not contain sufficient randomness to prevent an attacker from
   guessing the key. If such a command were issued on a system with no
   available randseed.bin file, then the resulting key may be
   This problem was discovered and analyzed by Germano Caronni
   <gec@acm.org>, and verified by Thomas Roessler <roessler@guug.de> and
   Marcel Waldvogel <mwa@arl.wustl.edu>. A copy of their analysis can be
   found at
II. Impact

          Keys produced non-interactively with PGP v5.0 on a system with
          a /dev/random device may be predictable, especially those
          produced in an environment without a pre-existing randseed.bin
          Documents encrypted with a vulnerable key may recoverable by an
          attacker. Additionally, an attacker may be able to forge a
          digital signature corresponding to a vulnerable key.
          Signatures produced using a vulnerable key, including
          signatures in certificates, may be untrustworthy.
III. Solution

          If your PGP key was generated non-interactively using any
          version of PGP v5.0 on a system with a /dev/random device, you
          may wish to revoke it.
          Documents encrypted with a predictable key may need to be
          re-encrypted with a non-vulnerable key, if your particular
          circumstances warrant it; that is, if the information still
          needs to be encrypted.
          You may need to resign documents signed with a vulnerable key
          if your circumstances warrant it.
Appendix A Vendor Information

Network Associates

          Network Associates Security Advisory
          Date: May 30, 2000
          Author: PGP Engineering
          A security issue has been discovered in the following PGP
     PGP 5.0 for Linux, US Commercial and Freeware editions
     PGP 5.0 for Linux, Source code book (basis for PGP 5.0i for Linux)
          The following PGP products are NOT affected by this issue:
          + PGP 1.x products
          + PGP 2.x products
          + PGP 4.x products
          + All other PGP 5.x products
          + PGP 6.x products
          + PGP 7.x products
          During a recent review of our published PGP 5.0 for Linux
          source code, researchers discovered that under specific, rare
          circumstances PGP 5.0 for Linux will generate weak, predictable
          public/private keypairs. These keys can only be created under
          the following circumstances:
          + Keys are generated using PGP's command line option for
            unattended batch key generation, with no user interaction for
            entropy (random data) collection
          + No keys were generated interactively on this system
            previously (e.g., a PGP random seed file is not present on
            this system prior to unattended batch key generation)
          + PGP is able to access the UNIX /dev/random service to gather
            entropy during unattended batch key generation
          PGP 5.0 for Linux does not process the data read from
          /dev/random appropriately, and therefore does not gather enough
          entropy required to generate strong public/private keypairs.
          This issue affects both RSA and Diffie-Hellman public/private
          keypairs, regardless of keysize. Network Associates has
          verified that this issue does not exist in any other version of
          Users who generated keys in the manner described above are
          strongly urged to do the following:
          + Revoke and no longer use keys suspected to have this problem
          + Generate new public/private keypairs with entropy collected
            from users' typing and/or mouse movements
          + Re-encrypt any data with the newly generated keypairs that is
            currently encrypted with keys suspected to have this problem
          + Re-sign any data with the newly generated keypairs, if
          Users are also urged to upgrade to the latest releases of PGP,
          as PGP 5.0 products have not been officially supported by
          Network Associates since early 1999, or distributed by Network
          Associates since June 1998.
          Additional Information:
          US commercial and freeware versions of PGP 5.0 for Linux were
          released in September 1997 by PGP, Inc., a company founded by
          Phil Zimmermann. Source code for the PGP 5.0 product family was
          published in September 1997. PGP, Inc. was acquired by Network
          Associates in December 1997.
          PGP appreciates the efforts of Germano Caronni, Thomas Roessler
          and Marcel Waldvogel in identifying this issue and bringing it
          to our attention.
          A pgp signed version of this statement is also available at
          The CERT Coordination Center thanks Germano Caronni, Thomas
          Roessler, and Marcel Waldvogel for initially discovering and
          reporting this vulnerability, and for their help in developing
          this advisory. Additionally we thank Brett Thomas for his
          Shawn Hernan was the primary author of this document.
          This document is available from:
CERT/CC Contact Information

        Email: cert@cert.org
                Phone: +1 412-268-7090 (24-hour hotline)
                Fax: +1 412-268-6989
                Postal address:
                CERT Coordination Center
                Software Engineering Institute
                Carnegie Mellon University
                Pittsburgh PA 15213-3890
          CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) /
          EDT(GMT-4) Monday through Friday; they are on call for
          emergencies during other hours, on U.S. holidays, and on
Using encryption

          We strongly urge you to encrypt sensitive information sent by
          email. Our public PGP key is available from
          If you prefer to use DES, please call the CERT hotline for more
Getting security information

          CERT publications and other security information are available
          from our web site
          To be added to our mailing list for advisories and bulletins,
          send email to cert-advisory-request@cert.org and include
          SUBSCRIBE your-email-address in the subject of your message.
          * "CERT" and "CERT Coordination Center" are registered in the
          U.S. Patent and Trademark Office.
          NO WARRANTY
          Any material furnished by Carnegie Mellon University and the
          Software Engineering Institute is furnished on an "as is"
          basis. Carnegie Mellon University makes no warranties of any
          kind, either expressed or implied as to any matter including,
          but not limited to, warranty of fitness for a particular
          purpose or merchantability, exclusivity or results obtained
          from use of the material. Carnegie Mellon University does not
          make any warranty of any kind with respect to freedom from
          patent, trademark, or copyright infringement.
          Conditions for use, disclaimers, and sponsorship information
          Copyright 2000 Carnegie Mellon University.
          Revision History
May 30, 2000:  initial release

Version: PGP for Personal Privacy 5.0
Charset: noconv


- --------------------------END INCLUDED TEXT--------------------

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:


If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.

Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key