🟠 High  |  Source: Microsoft Security Response Center

A vulnerability in Libgcrypt’s ElGamal encryption implementation (versions up to 1.8.2) means that plaintext messages are improperly encoded when encrypted directly, allowing an attacker to recover sensitive information from ciphertext alone. The root cause is that the Decisional Diffie-Hellman (DDH) assumption — a fundamental security property required for ElGamal to be secure — does not hold in this implementation. This effectively means ElGamal encryption in affected Libgcrypt versions provides no meaningful confidentiality protection.

Security Architect’s Take: Audit any Azure-hosted workloads or services that use Libgcrypt for ElGamal-based encryption and upgrade to a version beyond 1.8.2 immediately; also review whether any data previously encrypted using this library should be considered compromised and may require re-encryption with a patched implementation or a different algorithm.

Original advisory: CVE-2018-6829 cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt’s ElGamal implementation.