Vulnerability Note VU#26188
Keys generated with PGP5i batch mode do not contain sufficient randomness on systems that use /dev/random
Under certain circumstances, PGP v5.0 generates keys that are not sufficiently random, which may allow an attacker to predict keys and, hence, recover information encrypted with that key.
Generating Randomness in PGP Keys
In order to generate cryptographically secure keys, PGP (and other products) need to use random numbers as part of the input to the key generation process. Generating truly random numbers is a difficult problem. PGP has traditionally solved that problem by prompting the user to type some random characters or to move the mouse in a random manner, measuring the time between keystrokes and using this as a source of random data. Additionally, PGP uses a file (usually called randseed.bin) as a source of randomness. However, PGP also provides the ability to generate keys non-interactively (useful, for example, if you need to generate a large number of keys simultaneously or provide a script to generate a key). When generating keys non-interactively, PGP needs a source of random numbers; on some systems PGP v5.0 uses the /dev/random device to provide the required random numbers.
it does not contain sufficient randomness to prevent an attacker from guessing the key. If such a command were issued on a system with no available randseed.bin file, then the resulting key may be predictable.
This problem was discovered and analyzed by Germano Caronni <email@example.com>, and verified by Thomas Roessler <firstname.lastname@example.org> and Marcel Waldvogel <email@example.com>. A copy of their analysis can be found at
Keys produced non-interactively with PGP v5.0 on a system with a /dev/random device may be predictable, especially those produced in an environment without a pre-existing randseed.bin file.
If your PGP key was generated non-interactively using any version of PGP v5.0 on a system with a /dev/random device, you may wish to revoke it.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|PGP||Affected||-||11 Oct 2000|
|Network Associates||Unknown||-||11 Oct 2000|
CVSS Metrics (Learn More)
- http://www.securityfocus.com/templates/ archive.pike?list=1&msg=20000523141323.A28431@olymp.org
The CERT Coordination Center thanks Germano Caronni, Thomas Roessler, and Marcel Waldvogel for initially discovering and reporting this vulnerability, and for their help in developing this document. Additionally we thank Brett Thomas for his insights.
This document was written by Shawn V Hernan.
- CVE IDs: CVE-2000-0445
- CERT Advisory: CA-2000-09
- Date Public: 30 May 2000
- Date First Published: 10 Aug 2001
- Date Last Updated: 10 Aug 2001
- Severity Metric: 3.75
- Document Revision: 5
If you have feedback, comments, or additional information about this vulnerability, please send us email.