PGP Broken....by Mcafee?

I have got a simple job as a alpha-tester for McAffe and I found out something very strange while testing out a new product.
I was playing around with a SubSeven backdoor/server and I decided to encrypt it with the two PGP's system, keys and passphrases.
I had made two seperate archives all encrpyted with PGP.
I scanned both and...
It detected the backdoor/server which HAD NOT BEEN ACTIVATED.
I tried a different backdoor/server and it detected it again and even knew the type of virus.
All I have to say is WTF?
There has to be a plausible explaination.
PS - Sorry if I spelt anything wrong

Remember:
* I cleared ALL tempory files (Including PGP keys temp stuff)
* I did NOT activate the virus (I'm not that dumb)
* I even restarted the computer once, then scanned it
Yet it still detected it.
As far as I know, PGP's cipher is open source and it uses a prime nubmer system meaning the only way to even try anything is to find the factors of the number which can only be done by trial and error.
So what I am asking is HTF did is find the virus?
Looking forward to your responses

Could it be true? Has the goverment suceeded in putting a backdoor on PGP's software?

[edit on 21-8-2004 by couldntfindaname]

I have no doubt that the NSA has a backdoor in every major computer system and program. PGP is no exception. Even if they did not have one, the NSA ownes a large amount of supercomputers and could brute foce it if they had too.

They must have some computer equipment to do that especially since it was suppose to take 32^1024 million years to crack one character.
But also as well, it my computer that seemed to of cracked it and at the time I was not connected to the internet.

Originally posted by couldntfindaname
They must have some computer equipment to do that especially since it was suppose to take 32^1024 million years to crack one character.
But also as well, it my computer that seemed to of cracked it and at the time I was not connected to the internet.

Like I said the NSA has more supercomputers in its basement than most countries combined.

Wonders me that NSA would give the backdoor down to McApe so they can develop an anti-virus software that can scan PGP encrypted files.

I can't believe what you said. Either you are lying or you made a simple mistake you didn't think of.

Was it a PGP container or .sda file?

Hey guys i'd also like to point out that the name says it all "Pretty Good Privacy." When im dabbing on my Windows OS (which is usually at work) I always encrypt and rename using a FREE program called Axcrypt its a compressor and encryption program. It uses AES,SHA-1 and Zlib implementations. Its very similar to PGPdisk except without all the publicity which makes it a neat little utility.

P.S Yes i know that PGP uses an AES 256 bit symmetric key and RSA 4096 support (atleast in the new freeware editions it did) the point was to drift away from mainstream security.

And of course the link.. if anyone is interested:

sourceforge.net...

Linux:

I am somewhat of an expert in cryptography and can say that, unless McAffee has the pass phrase to the secret keyring, it is IMPOSSIBLE to decrypt a PGP message.

Even brute-force attacks these days with the ley lengths they use is impossible - even for super-computers. The symmetrical key length is determined so that if a brute-force attack is done then by the time the data is de-crypted, it is useless anyway.

Out of curiosity, what two PGP systems did you use?

Try taking the encrypted file and putting it on another computer.

Cheers

JS

Originally posted by jumpspace
I am somewhat of an expert in cryptography and can say that, unless McAffee has the pass phrase to the secret keyring, it is IMPOSSIBLE to decrypt a PGP message.

Before I start, im not an expert on cryptography. I have taken a few jogger courses and introductions on the basic math and logic behind some ciphers like RSA.

I have to agree with you that without the keyring its virtually impossible to crack even IF the key size was smaller (as in 128 bit). It would take billions of years to crack this even with some of the toughest super computers. As im sure you already knew 2048 bit keys are widely available and if the 128 bits are hard to crack image those.

RSA has always been under fire and advances in number theories may lead to a polynomial time factoring algorithm that could greatly reduce the brute force time to crack smaller keys. Secondly the fundamentals of RSA and perhaps even AES are not perfect and reverse engineering could reveal flaws - to the best of my knowledge none exist as of yet.

Lastly im sure that NSA wouldn't have PGP be so secure that even they couldn't break it. Who's to say that the giant corporations aren't working hand in hand, I know that Symantec and PGP are currently working with each other and im sure its only a matter of time before Mcafee (if they already aren't) start working together with PGP.

www.securitypipeline.com...

As of right now im using the PGP 7.0 freeware.

Linux:

The PGP standards are impossible to crack, but yes, kahooting PGP "providers" via freeware etc would (I suspect) give a backdoor to the NSA type people.

You should actually see the source code for some of the freeware PGP systems - it is spaghetti programming to the extreme and quite easy to hide a "back-door".

The best way to encrypt something is the olde method of common symmetrical keys between sender and receiver. The sender and receiver have the same symmetrical "key" to encrypt and decrypt the data...no secret key rings etc etc - just a big long bit of text that is used to encrypt the data. For example, you could even use a book if you wanted to...taking the first 1000 characters as the symmetrical key and the next 1000 characters etc etc. Books can be referenced and cracked, however a book of randomly generated characters would be impossible to crack (unless the "interceptors" got hold of the book).

The trick is to exchange this "book of symmetrical keys" in secret. Over the internet is not secret (you have middle-men to deal with, ie echelon, other agencies etc) so you really need to meet the receiver in person...and if you haven't met the person before, how do you REALLY know that's him standing in front of you?

Ah, the possibilities

Cheers

JS

I find it very unlikely that PGP was cracked by McAffe, only maybe if it was an user error when running the encryption to begin with. PGP is very powerful, remember the big deal between the FBI and the developers when it first came out?

there was a lot of talk about PGP for email backdoors amongst the geek set a few years ago after the inventor, Phil Zimmerman (total hero of freedom on the the pre911 internet), left. He left after Network Associates who later owned his tech limited publication of the sourcecode. Network Associates became, you guessed it, Mcafee.
So, I'd say you've just proven they are using their own backdoor to look within your pgpencrypted files. Would they offer a similar backdoor to the FBI etc. Of course.
Answer, probably to find an OLD, copy of pgp or use a different tech.

open.itworld.com...
www.mcafee.com...

btw, well done. The backdoor thing with pgp has been discussed on forums and usenets for ages and I've never seen it proved so well before (assuming you double checked you did it all properly. You should post this in one of the encryption forums or news groups. THey'll LOVE you.

why don't you try encrypting the subseven file with a different encryptor, even something pissy, and rescanning, just to double prove it lol.

and in case some here are too young to remember all this, 10 years flies, have a search for Phil Zimmerman's story, it rips. He posted the source code onto a website and it was OUT before the authorities could stop it. Instant net fame+++. They tried to nab him for arms trading etc etc.

jumpspace

The trick is to exchange this "book of symmetrical keys" in secret. Over the internet is not secret (you have middle-men to deal with, ie echelon, other agencies etc) so you really need to meet the receiver in person...and if you haven't met the person before, how do you REALLY know that's him standing in front of you?

You havent quite got it. Its far more slick.
You generate 2 keys (eg 2 ENORMOUS primes) and send me Key2. I, or anyone elsewith key2, can use Key2 to encrypt the mail. The email is undecipherable without Key1 which still resides on your harddrive and which you've kept secret and unshared.

ie you can publish Key2 on ATN if you want and not compromise the security of the system. Its so simple and so brilliant.

Originally posted by Romeo
You havent quite got it. Its far more slick.
You generate 2 keys (eg 2 ENORMOUS primes) and send me Key2. I, or anyone elsewith key2, can use Key2 to encrypt the mail. The email is undecipherable without Key1 which still resides on your harddrive and which you've kept secret and unshared.

Thats basically the Private and Public key relationship you just expressed. The two primes are multipled together to form a private key. When you use large primes the result can take (in theory) 90 Million Mips years (millions of instructions per second). Only problem here is what jumpspace stated above, in all that code its easy to inject a nasty backdoor. That would completely tear down any sort of security - what kind of security allows another to take a look.

Your PGP install is likely configured to cache your passphrase and is decrypting the encrypted file on the fly as McAfee requests access to the file. For the sake of argument, I tested this with PGP Corporate and McAfee Virus Scanner using a Zip and PGP encrypted file. McAfee only found the virus within the Zip and found nothing within the PGP encrypted file.

I believe the NSA and the like have the brains, CPU horsepower and the budget to decrypt PGP to at least 1024 bits. If you have your new home PC try every possible key to decrypt a 512 bit key, your fancy new PC would likely finish in about a decade. Increasing the bit length to 1024 bits will increase the difficulty by about one million. So did your McAfee virus scan decrpyt your PGP encrypted file? Absolutely not.

SonetRing

Originally posted by SonetRing
I believe the NSA and the like have the brains, CPU horsepower and the budget to decrypt PGP to at least 1024 bits. If you have your new home PC try every possible key to decrypt a 512 bit key, your fancy new PC would likely finish in about a decade.

Remember when the RSA challenge was solved in 1994? Based on 1977 technology they estimated it would take roughly 40 quadrillion years (40x10^15). How long did it take using 90's technology? less then 7 minutes to test the prime numbers, of course the key size was alot smaller (I think it was 126 digit numbers they were talking about). I don't know the exact formula but to crack a 2048 bit key would take ALOT of mainframes.

*Pssst, Romeo, there's an edit button for a reason. That reason is so that you DO NOT POST 6 TIMES IN A ROW. Thank you. Please use it in the future. -- By the way though, nice contribution to the topic. *

Alright, now that's out of the way - how on earth did the NSA get dragged into this? What the hell is FredT thinking?

couldn'tfindaname: "Mcaffee broke PGP"
FredT: Holy Crap the NSA knows everything!

-- Is anyone else here a little, well, wondering about this one?


Anyrate, yeah, there's no way Mcaffee did it, SonetRing seems to have a good explanation, that's about the lines I was thinkin along. Or you're lying, which is the less likely of the two.