GnuPG 2.2.0 がリリース（脆弱性の修正あり）

This release marks the start of a new long term support series to replace the 2.0.x series which will reach end-of-life on 2017-12-31.

We demonstrate the effect of this vulnerability on three software applications---encrypted git, email and messaging---that use Libgcrypt. In each case, we show how to craft malicious OpenPGP files that use the Curve25519 point of order 4 as a chosen ciphertext to the ECDH encryption scheme. We find that the resulting interactions of the point at infinity, order-2, and order-4 elements in the Montgomery ladder scalar-by-point multiplication routine create side channel leakage that allows us to recover the private key in as few as 11 attempts to access such malicious files.

For an attack on encrypted email we use the Thunderbird plugin Enigmail. As Genkin et al. observe, Enigmail automatically decrypts incoming emails by passing them to GnuPG, which uses Libgcrypt as its cryptographic engine. To attack Enigmail, we inject an element of order 4 into Libgcrypt we send the victim a PGP/MIME-encoded e-mail, with the element of order-4 as the ciphertext.