Problems
| The neutrality of this section is disputed. Please do not remove this message until the dispute is resolved. |
The OpenPGP standard specifies several methods of digitally signing messages. In 2003, due to an error in a change to GnuPG intended to make one of those methods more efficient, a security vulnerability was introduced. It affected only one method of digitally signing messages, only for some releases of GnuPG (1.0.2 through 1.2.3), and there were fewer than 1000 such keys listed on the key servers. Most people did not use this method, and were in any case discouraged from doing so, so the damage caused (if any, and none has been publicly reported) would appear to have been minimal. Support for this method has been removed from GnuPG versions released after this discovery (1.2.4 and later). Two further vulnerabilities were discovered in early 2006; the first being that scripted uses of GnuPG for signature verification may result in false positives, the second that non-MIME messages were vulnerable to the injection of data which while not covered by the digital signature, would be reported as being part of the signed message. In both cases updated versions of GnuPG were made available at the time of the announcement.
GnuPG is a command-line based system, that is not written as an API which can be incorporated into other software. GPGME is an API wrapper around GnuPG which parses the output of GnuPG, and various graphical front-ends based on GPGME have been created. This currently requires an out-of-process call to the GnuPG executable for many GPGME API calls. Because GPGME makes use of a special GnuPG interface designed for machine use, a stable and maintainable API between the components is given. Possible security problems in an application do not propagate to the actual crypto code due to the process barrier.
Read more about this topic: GNU Privacy Guard
Famous quotes containing the word problems:
“I had many problems in my conduct of the office being contrasted with President Kennedy’s conduct in the office, with my manner of dealing with things and his manner, with my accent and his accent, with my background and his background. He was a great public hero, and anything I did that someone didn’t approve of, they would always feel that President Kennedy wouldn’t have done that.”
—Lyndon Baines Johnson (1908–1973)
“It is not impossible, of course, after such an administration as Roosevelt’s and after the change in method that I could not but adapt in view of my different way of looking at things, that questions should arise as to whether I should go back on the principles of the Roosevelt administration.... I have a government of limited power under a Constitution, and we have got to work out our problems on the basis of law. Now, if that is reactionary, then I am a reactionary.”
—William Howard Taft (1857–1930)
“It’s so easy during those first few months to think that the problems will never end. You feel as if your son will never sleep through the night, will always spit up food after eating, and will never learn to smile—even though you don’t know any adults or even older children who still act this way.”
—Lawrence Kutner (20th century)