This bug has an associated CVE id.
Such bugs often have restricted access before the publication. Take care that this bug tracker does not yet encrypt mails to subscribers, so for highly sensitive issues take care what you comment in the report while it is still restricted.
This bug is CVE-2022-47629
Fixed Gpg4win version: https://lists.wald.intevation.org/pipermail/gpg4win-announce/2022/000098.html
As usual see https://gnupg.org/download for links to the latest packages. For Gpg4win see https://gpg4win.org
As 2.3.7 was released on the 11th of July, see https://lists.gnupg.org/pipermail/gnupg-announce/2022q3/000474.html
I guess that this issue should be closed and some issues moved to one with 2.3.8.
Updated the copy on our mirror as welll as the gpg4win and swdb packages files.
The fix is from 2018 but was not picked up widely; see
https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531
SWDB updated - thus the latest zlib will be part of the next Windows build.
All 4 CVEs are findings related to standard conforming compiler optimizations which OTOH break long standing assumptions on C coding. “Let us show that our compiler produces the fastes code ever and ignore any assumptions coders had made over the last 50 year”.
Thanks for the clarification!
The problem of (2), is local side-channel attacks to ElGamal encryption.
We evaluated the impact, mainly for the use case of GnuPG; ElGamal keys are not that popular any more. When such an attack is possible, easier attacks would be possible.
I looks like the "cipher: Hardening ElGamal by introducing exponent blinding too." commit [1] was never applied to 1.8.x. Is that intentional? If so, is there a specific reasoning that it's not needed in 1.8.x? Thanks!
CVE-2021-33560
Let me rephrase from a viewpoint of mine (an implementer).
The paper describes another problem: interoperability (or interpretation) of "ElGamal encryption", and its impact.
Do we have CVE number assigned?
This would be difficult to set up for DSA. Remotely controlled
environment, asking signing same message, using deterministic
DSA... would be not that practical.
So, in my opinion, applying the patch for ElGamal exponent blinding is enough (for now).
For DSA, I had assumed similar attack could be effective.
Our tentative plan is:
Fix has been released. Keeping this in testing state for easier visibility of this task.
Gpg4win 3.113 has also been released. Thus closing this issue.
Small correction: The fixed byte I talked about may have the values 1, 2, 3, or 4.
This has CVE-2020-25125