Elgamal Decryption Flaw in Libgcrypt and GnuPG Products

CVE-2014-3591

Summary

Libgcrypt versions prior to 1.6.3 and GnuPG versions below 1.4.19 are susceptible to a vulnerability that lacks ciphertext blinding for Elgamal decryption. This flaw enables an attacker in close physical proximity to potentially extract the server's private key by analyzing crafted ciphertext in conjunction with fluctuations in electromagnetic radiation during the decryption process. This poses a critical risk to the confidentiality of encrypted data, making it essential for users of these libraries to update to secure versions.

References