openSUSE: 2019:1951-1: moderate: Recommended dkgpg, libTMCG

    Date19 Aug 2019
    CategoryopenSUSE
    251
    Posted ByLinuxSecurity Advisories
    An update that contains security fixes can now be installed.
       openSUSE Security Update: Recommended update for dkgpg, libTMCG
    ______________________________________________________________________________
    
    Announcement ID:    openSUSE-SU-2019:1951-1
    Rating:             moderate
    References:         
    Affected Products:
                        openSUSE Leap 15.1
                        openSUSE Leap 15.0
    ______________________________________________________________________________
    
       An update that contains security fixes can now be installed.
    
    Description:
    
    
    
       This update for dkgpg, libTMCG fixes the following issues:
    
       libTMCG was updated to version 1.3.18
    
       * This release is two-fold: first, it fixes some bugs (e.g. iterated S2K)
         of the OpenPGP interface, and second, it adds functionality for handling
          v5 keys and signatures (see RFC 4880bis-07).
    
       Update to version 1.3.17
    
       * VTMF,ASTC,DKG,VRHE,EOTP,COM,VSS: make CheckGroup() more robust
       * VSSHE: security bugfix for Verify_[non]interactive_[_publiccoin]
       * mpz_spowm: added check for correct base in fast exponentiation
       * mpz_sqrtm: remove unused parameter in tmcg_mpz_qrmn_p()
       * configure.ac: added compiler option "-Wextra"
       * mpz_sprime: added tmcg_mpz_smprime() with increased B = 80000
       * RFC4880: changed type of tmcg_openpgp_mem_alloc to unsigned long
    
       Update to version 1.3.16
    
       * changed constant TMCG_MAX_CARDS (decreased by factor 2)
       * changed formulas for TMCG_MAX_VALUE_CHARS and TMCG_MAX_KEY_CHARS
       * RFC4880: added support of Preferred AEAD Algorithms [RFC 4880bis]
       * RFC4880: added output for key usage "timestamping" [RFC 4880bis]
       * RFC4880: changed tmcg_openpgp_byte_t: unsigned char -> uint8_t
       * RFC4880: added PacketAeadEncode() [RFC 4880bis]
       * RFC4880: added SymmetricDecryptAEAD() and SymmetricEncryptAEAD()
       * changed formula for TMCG_MAX_KEYBITS (increased by factor 2)
       * mpz_srandom: bugfix in Botan code branch of mpz_grandomb()
    
       Update to version 1.3.15:
    
       * This is a maintenance release that fixes some bugs, e.g. in the Botan
         support of functions from module mpz_srandom. Moreover, some interfaces
         of the OpenPGP implemenation have been added and removed. For some
          modules of LibTMCG a basic exception handling has been introduced.
    
       Update to version 1.3.14:
    
       * With this release three additional parameters for the control of secure
         memory allocation have been added to init_libTMCG(). They are explained
         in the reference manual. Moreover, the OpenPGP interface has been
         enhanced in several way, e.g., ECDH, ECDSA and EdDSA are supported now.
    
       Update to 1.3.13:
    
       * Lots of major improvements for undocumented OpenPGP interface
       * PRNG from Botan is used as additional source of randomness
       * SHA3 is emulated if runtime version of libgcrypt is too old
    
       dkgpg was updated to version 1.1.3:
    
       * This is a bugfix release that includes only three minor improvements: a
         direct-key signature (0x1f) for the primary key is added by default such
         that restricting key servers (e.g. keys.openpgp.org) can deliver a
         cryptographically checkable key without verification of any included
         user ID or without appended subkey. The command line interface of
         dkg-decrypt has been improved in order to give users an easy access to
         the symmetric-key decryption mode. An additional option ("-5") for
         dkg-sign allows to generate V5 signatures (cf. draft RFC 4880bis).
    
       Update to version 1.1.2:
    
       * This release adds a lot of features to some programs: two new options
         ("-K" and "-f") allow dkg-keysign to read the certification key from a
         keyring instead of a single key block file. Moreover, with option "-a"
         an interactive confirmation by the user is required for each signature.
         Passive support of V5 keys (cf. draft RFC 4880bis) has been added for
         all programs, however, dkg-generate still generates V4 keys only,
         because this new feature of the draft is not widely spread. There is
         also a new encryption capability: an empty KEYSPEC tells dkg-encrypt to
         create a symmetric-key encrypted session key, i.e., the user has to
         supply a passphrase for encryption and decryption without any public-key
         cryptography involved. Last but not least, two bugs have been fixed:
         First, dkg-decrypt failed on many ZIP-compressed OpenPGP messages with
         "ZLIB ERROR: -3 invalid block type" due to a bug in decompression logic.
         Second, dkg-decrypt failed in a special case of symmetric-key encrypted
         session keys. Finally, the non-installing program dkg-fuzzer (generates
         fuzzy samples of somehow corrupted OpenPGP stuctures) has been added.
    
       Update to version 1.1.1:
    
       * Some small improvements have been applied for dkg-generate: Two new
         options ("-u" and "-N") allow providing the initial user ID and to
          disable the passphrase at command line. Moreover, since this release
          dkg-timestamp and dkg-timestamp-verify require a special key usage flag
          from recent RFC 4880bis draft to select so-called timestamping keys.
          Finally, the synchronization time of the internally used broadcast
          protocol was reduced to a more reasonable amount and in dkg-decrypt the
          detection of end of data for message and decryption shares was changed.
    
       Update to version 1.1.0:
    
       * This release supports Authenticated Encryption with Associated Data
         (AEAD) in accordance to RFC 4880bis (draft); this can be enforced with
         the new added option "-a" when  dkg-(d)encrypt is used. For using domain
         parameters, as described in RFC 7919, one should specify the new option
         "-r", when dkg-gencrs is used. Last, for key generation (dkg-generate)
         the timestamp
         option was added ( "--timestamping") which sets a key usage flag.
    
       - Update to version 1.0.9 This release improves the possibilities of DKGPG
         further. With the new programs dkg-adduid and dkg-revuid an user ID can
         be added and revoked, respectively. The program dkg-revoke now supports
         a human-readable reason for revocation (by option "-R") and dkg-decrypt
         verifies an included signature according to a given key ring (option
         "-k"). Last but not least, by the program dkg-addrevoker an external
         revocation key can be specified.
    
       Update to version 1.0.8:
    
       * First of all, passive support for ECDSA, ECDH, and EdDSA (cf. RFC 6637
         and Werner Koch's draft RFC 4880bis) has been added by relying on the
         most recent version of LibTMCG. The threshold signature scheme and the
         threshold encryption are still limited to finite field cryptography
         (i.e. DSA and ElGamal). Moreover, the programs generate and recognize a
         few other new OpenPGP features (e.g. issuer fingerprint subpackets) from
         RFC 4880bis. Compressed messages are now decompressed by the program
         dkg-decrypt using zlib Compression Library (and optionally by library
         routines from libbzip2). This completes DKGPG's compatibility with other
         OpenPGP software, however, the prefered compression algorithm (i.e. "no
         compression") in self-signatures of generated keys is kept for now.
         Support for symmetric-key decryption by dkg-decrypt has been added too.
         The program dkg-verify now reads the signature from a file, if option
         "-s" is used. To keep track of later protocol changes, all interactive
         programs include a version identifier in their common ID of the reliable
         broadcast channel. Thus programs from previous releases will not
         communicate with those of this release. With the new programs
         dkg-timestamp and dkg-timestamp-verify a OpenPGP timestamp signature can
         be generated and verified, respectively. Last but not least, by the new
         option "-y" some programs (dkg-generate, dkg-decrypt, dkg-sign,
         dkg-keysign, and dkg-timestamp) will work with regular OpenPGP keys too.
         The README file contains a configuration sample showing how to replace
         classic PGP by DKGPG in the famous mail user agent mutt based on this
         option. Please note that this feature is experimental and semantics may
          be changed later.
    
       Update to 1.0.7:
    
       * Small improvments due to the new OpenPGP structures from libTMCG
       * "-k" option has been added to further programs
       * OpenPGP cleartext signatures can be generated with the "-t" option
       * Output of potentially malicious user IDs has been sanitized in
         dkg-keycheck, dkg-keyinfo, and dkg-keysign
    
    
    Patch Instructions:
    
       To install this openSUSE Security Update use the SUSE recommended installation methods
       like YaST online_update or "zypper patch".
    
       Alternatively you can run the command listed for your product:
    
       - openSUSE Leap 15.1:
    
          zypper in -t patch openSUSE-2019-1951=1
    
       - openSUSE Leap 15.0:
    
          zypper in -t patch openSUSE-2019-1951=1
    
    
    
    Package List:
    
       - openSUSE Leap 15.1 (x86_64):
    
          dkgpg-1.1.3-lp151.3.3.1
          dkgpg-debuginfo-1.1.3-lp151.3.3.1
          dkgpg-debugsource-1.1.3-lp151.3.3.1
          libTMCG-debugsource-1.3.18-lp151.3.3.1
          libTMCG-devel-1.3.18-lp151.3.3.1
          libTMCG18-1.3.18-lp151.3.3.1
          libTMCG18-debuginfo-1.3.18-lp151.3.3.1
    
       - openSUSE Leap 15.0 (x86_64):
    
          dkgpg-1.1.3-lp150.2.3.1
          dkgpg-debuginfo-1.1.3-lp150.2.3.1
          dkgpg-debugsource-1.1.3-lp150.2.3.1
          libTMCG-debugsource-1.3.18-lp150.2.3.1
          libTMCG-devel-1.3.18-lp150.2.3.1
          libTMCG18-1.3.18-lp150.2.3.1
          libTMCG18-debuginfo-1.3.18-lp150.2.3.1
    
    
    References:
    
    
    -- 
    

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"13","type":"x","order":"1","pct":54.17,"resources":[]},{"id":"88","title":"Should be more technical","votes":"4","type":"x","order":"2","pct":16.67,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"7","type":"x","order":"3","pct":29.17,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.