GnuPG ElGamal Signing Keys Compromised
Friday November 28, 2003
If you have created and used ElGamal sign+encrypt (type 20) keys in GnuPG, you should immediately revoke them as your private key can be fully compromised within seconds. The advisory has detailed instructions how to do this and also contains background information how this severe problem came about.
Note that the default keys used by GnuPG (DSA and ElGamal) and RSA keys are not affected. Only a tiny portion of all GnuPG keys are of the problematic type. While it is unlikely yours is one of them, you should still check to be sure, though. Instructions how to detect ElGamal sign+encrypt keys are in the advisory.
Note that the default keys used by GnuPG (DSA and ElGamal) and RSA keys are not affected. Only a tiny portion of all GnuPG keys are of the problematic type. While it is unlikely yours is one of them, you should still check to be sure, though. Instructions how to detect ElGamal sign+encrypt keys are in the advisory.


Comments
No comments yet. Leave a Comment