STE WILLIAMS

High performance access to file storage

The leak of a PGP-encrypted email between Ed Snowden’s pet journalist Glenn Greenwald and a lawyer has created a bit of a fuss in crypto circles.

Jesselyn Radack, a national security and human rights brief, ‪has confirmed that she sent encrypted emails later leaked by a person ‬or persons unknown to Cryptome, an online library for whistleblowers.

Radack is one of Edward Snowden’s lawyers, something that adds spice to the already heady mix of tech intrigue.

The contents of the message itself are not particularly sensitive (it references Greenwald’s McGill journalism award and the upcoming Polk media event, neither of which is secret or confidential).

Quite how the leak took place, by contrast, has become the focus of interest and speculation.

One theory postulates‪ that, rather than the leak having to do with breaking PGP encryption, somebody somehow tricked ‬Radack ‪into sending the message to a third account, as well as the accounts controlled ‬by Greenwald and Radack herself.

It’s possible that a malware infection of Radack’s machine might have played a part. But the more likely explanation is that Radack was somehow tricked into adding an unsigned (and unverified) PGP key onto her keyring.

‪The original leak allegedly omitted crucial information that the message was sent to a mysterious third party, according ‬to the disputed theory.

“I have a copy of the full original email and it is encrypted to three keys. Two of them are correct and the third is a likely hostile party,” said ‪Tor developer Jacob Applebaum in the first of a series of Twitter updates about the leak. “‬The third key involved is for an email address that may be run by a hostile party, with a PGP key. It is not controlled by Glenn [Greenwald] or Jess [Radack].

“It appears that the person who leaked the PGP encrypted text took out the metadata about a third key, which explains the ability to decrypt,” he added.

‪Applebaum‬ suggests that Cryptome is being manipulated as part of a disinformation campaign. “I think you are actively being played by someone to mess with everyone involved,” he told the digital leak site.

Cryptome itself, however, is not altogether convinced about this scenario. It said it remained open to the possibility that some vulnerability involving PGP may somehow be in play, among other possibilities.

Cryptome views the Jacob Appelbaum’s information in a message below an allegation similar to the original message. The message he provided could be tampered with as alleged of the original. PGP vulnerabilities are well known among comsec experts but not the public. Comsec experts often conceal vulnerabilities out of self-interest, instead provide misleading information – a practice widespread in most security industries.

A discussion on the issue, featuring various contrasting views as well as the leaked email, can be found here.

US security experts with a patriotic – generally pro-NSA – perspective (such as the th3j35t3r here), along with former NSA staffers (here), delighted in the whole episode while others took a more neutral stance.

“If this leaked email on Cryptome were from or to me, I’d generate a new PGP key and wipe my computer, pronto,” said Christopher Soghoian of the American Civil Liberties Union (ACLU), in an update to his personal Twitter account. ®

High performance access to file storage

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2014/04/10/pgp_email_leak_mystery_snowden_greenwald/