CVE-2021-40530

Vulnerability

The vulnerability resides in the ElGamal implementation in Crypto++ versions through 8.5 [1][3]. During interaction between two cryptographic libraries—specifically, when a sender uses Crypto++ to encrypt a message with an OpenPGP public key generated by another library—a dangerous combination of the prime and generator defined by the receiver's public key and the sender's ephemeral exponents leads to a cross-configuration attack [1][3]. This occurs because different OpenPGP implementations interpret the ElGamal component of the OpenPGP standard in subtly different ways, creating interoperability mismatches that expose plaintexts [1][3].

Exploitation

An attacker can recover the plaintext from a single captured ciphertext without needing the private key [1][3]. The attacker only needs network access to observe ciphertexts; no authentication or interaction with the sender or receiver is required [1]. The attack exploits the fact that one implementation's ciphertext generation can be decrypted by an arbitrary library using the same public key, due to incompatible parameter handling [1][3]. Over 2,000 vulnerable public keys were identified in the wild [1].

Impact

Successful exploitation leads to complete disclosure of the plaintext encrypted in the affected ciphertext [1][3]. The confidentiality of the encrypted data is fully compromised. The attack does not recover the private key, so only the specific ciphertexts generated under the vulnerable cross-configuration are affected; future communications are not automatically compromised unless the same parameter mismatch persists [1][3].

Mitigation

As of the publication date (2021-09-06), no fixed version of Crypto++ has been released [1][2]. The advised mitigation is for implementations to strictly adhere to the OpenPGP specification by properly validating and using the prime and generator from the public key, and to avoid generating ElGamal keys with unsafe parameters [1][3]. Users should ensure their OpenPGP libraries are updated to handle ElGamal consistently; the researchers recommended using libraries that implement the standard without deviations [1]. Workarounds include not using ElGamal encryption in OpenPGP or generating keys with carefully chosen parameters [1][3].