To Sign or Not to Sign: Uncovering Practical Vulnerabilities in GPG and Related Tools
A deep dive into recently discovered vulnerabilities in popular PGP implementations like GnuPG, Sequoia PGP, age, and minisign reveals implementation flaws that could undermine cryptographic security. These bugs, rooted in parsing errors rather than cryptographic math, pose risks from signature bypasses to memory corruption. Presented at the 39th Chaos Communication Congress, the findings highlight the ongoing challenges in securing mature cryptographic codebases.