ElGamal Key Component Flaw in GnuPG Signing and Encryption

CVE-2003-0971

What is CVE-2003-0971?

GnuPG versions 1.0.2 through 1.2.3 exhibit a serious cryptographic flaw in how ElGamal type 20 keys are generated. The encryption and signing processes utilize the same key component, which creates a significant security risk. This vulnerability could allow malicious actors to derive the private key from a signature, enabling unauthorized decryption and further compromising user data and communications.

References