full-disclosure-uk January 2010 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: [Full-disclosure] 0xdeadbeef attack on gpg

[Full-disclosure] 0xdeadbeef attack on gpg

From: Sens0r The real <the.real.sens0r_at_nospam>
Date: Sun Jan 17 2010 - 21:04:35 GMT
To: full-disclosure@lists.grok.org.uk

Hello list,
I'm currently digging into the security aspect of RSA and web of trust... while searching the web I found some notes about the 0xdeadbeef attack, where you generate a key that has the same short fingerprint than another, and over this way you fool other users to use the wrong key.

So I'm searching information about this hack, I did not found any paper on the usual places, and I don't find much information at all.

How does this attack was done in practice? I mean you have to generate a fingerprint that has as last 8 bytes 0xdeadbeef (hex) that clear for me, but what is the best way? You could simply generate one key after the other and throw away every key that is not matching, but this might last for quite a long time if you are unlucky.

How does one could influence it to get a result faster? I would be happy for every hint/link/information.

Kind regards,

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/