HackDig : Dig high-quality web security articles for hacker

Once-starving GnuPG crypto project gets a windfall. Now comes the hard part

2015-02-07 00:05

For almost two decades, the open source GnuPG encryption project has teetered on the brink of insolvency. Now, following word of that plight, the lone developer keeping the project alive has received more than $135,000—in a single day, no less.

Short for Gnu Privacy Guard, GnuPG or simply GPG was first conceived in 1997. It makes up the guts that run GpG4Win, GPG Tools, and Enigmail, encryption programs that run on Windows, Macs, and as a plugin for the Thunderbird e-mail program respectively. An open source version of Phil Zimmermann's PGP, GnuPG quickly surged in popularity. Because it was written by a German citizen outside the US, it wasn't subject to then-draconian US laws restricting the export of strong cryptography technologies. Former NSA whistleblower Edward Snowden relied on the program to evade monitoring as he carried out his massive leak of top-secret documents. Many journalists and security professionals also swear by it.

Despite the popularity of the program, Werner Koch has struggled to make ends meet. According to a profile published Thursday by ProPublica, the 53-year-old resident of Erkrath, Germany, grew so impatient with the lack of funding that he considered abandoning the project and taking a better paying programming job. When documents leaked in 2013 by Snowden showed the extent of NSA surveillance, he decided the time wasn't right to drop the project. He has been stuck in limbo ever since.

Things took a dramatic about-face following the ProPublica post. According to the GnuPG front page, the project brought in €120,000 (the equivalent of about $135,600) in donations in the first 24 hours following publication. That didn't include a $60,000 infusion that was recently donated from a group called the Core Infrastructure Initiative and payments of $50,000 each from Facebook and payment service Stripe.

Now what?

The financial strain Koch has endured underscores a cruel irony that has only recently come to light. Developers of some of the most sensitive and mission-critical software often struggle to maintain their projects, while many who sell smartphone apps and other comparatively less crucial software are flush with cash. It wasn't until last year's surfacing of the catastrophic Heartbleed vulnerability in the OpenSSL crypto library that it became common knowledge the project had just one employee working full time and typically received just $2,000 per year in donations. In response, the Linux Foundation spearheaded the Core Infrastructure Initiative to fund OpenSSL and similar projects. The initiative gets financial support from the likes of HP, IBM, Red Hat, Intel, Oracle, Google, Cisco, and others.

It's encouraging to see the GnuPG project benefitting from similar largess. But it also raises the question: how is the money best spent? Matt Green, a professor specializing in cryptography at Johns Hopkins University, said he has looked at the GnuPG source code and found it in such rough shape that he regularly assigns chunks of it to his students for review.

"At the end I ask how they felt about it and they all basically say: 'God, please I never want to do something like this again,'" Green told Ars.

The main problem with the code, he said, is it hasn't been properly maintained over the years.

"It's overly complex," he explained. "It's not maintained by enough people, given how big it is, and it contains a lot of old cruft that should be gotten rid of. When it got re-engineered from version 1 to version 2, version 2 got re-engineered in this abstract way [so] that it's hard to figure out what's going on on the back end."

The complexity and excess code are of concern because they may contain vulnerabilities that a skilled hacker could exploit to decrypt messages or obtain users' private keys. Given the ramshackle state of massive GnuPG code base, it's not clear what's the best path forward. A code audit is one possibility, but such reviews typically cost a minimum of $100,000 for complex crypto programs, and it's not unheard of for the price to be double that. Meanwhile, Google and Yahoo are proceeding with End-to-End, a project that aims to rewrite PGP code from scratch to make e-mail encryption easier. No doubt, GnuPG won't go away any time soon. Still, it's not clear whether it makes sense to dump massive amounts of cash to refurbish code in such disrepair.

A similar debate has swirled around OpenSSL, with one camp embarking on an audit while an opposing one is rewriting the library from scratch.

"A real audit of the [GnuPG] code would be great," Green said. "The problem is it would be really expensive and I'm not sure it's worth it."

Source: i-nac-tub-llafdniw-a-steg-tcejorp-otpyrc-gpung-gnivrats-ecno/20/5102/ytiruces/moc.acinhcetsra

“Once-starving GnuPG crypto project gets a windfall. Now comes the hard part”0 Comments

Submit A Comment



Blog :

Verification Code:


Share high-quality web security related articles with you:)


Tag Cloud