Question -- have there been any documented cases of weak encryption leading to significant exploits? I don't mean to belittle the need for encryption but I don't see significant exploits actually happening. Maybe the right attitude is to say if we did not keep up that we would be seeing exploits. >>> Steve Beattie <steve@private> 04/17/02 19:34 PM >>> On Wed, Apr 17, 2002 at 07:34:19AM -0700, George Heuston wrote: > SSL keys coming up short. More than 15 percent of the Secure Sockets > Layer (SSL) servers in the US are using short RSA keys that are in > danger of being compromised with off-the-shelf products and computing > resources available to individuals in most medium-size businesses. SSL > is the de facto standard protocol used to encrypt data going to and > from Web sites, typically for financial transactions on e-commerce > sites. If the RSA key is compromised, an attacker is able to impersonate > the Web site and decrypt traffic intercepted to or from the site. > (Eweek, 15 Apr) > > WWU Comment: The significance of this issue lies in the potential for > individuals with semi-sophisticated capabilities who have access to > readily-available resources to take advantage of lesser security key > implementations of widely used security products. The stature of SSL > as the de facto standard offers a false sense of security when using > the lesser security key implementation in the same manner that fire > walls and intrusion detection systems that are poorly configured fail > to provide adequate protection. It is with great humor that I read this blurb from NIPC, especially their additional comment. The whole idea of the US federal government complaining that too man people are using weak encryption when the US government has been one of the strongest impediments to adopting strong encryption through its ITAR restrictions (crypto is a munition!) is just laughable. Alas, Phil Zimmerman wasn't laughing when he was being threatened with years in jail for distributing PGP. Of course, using strong crypto only buys you transport security. Given the depressing state of host security, using SSL to most websites is like using an armored car to transport your money to a bank made out of a cardboard box. -- Steve Beattie Don't trust programmers? <steve@private> Complete StackGuard distro at http://NxNW.org/~steve/ immunix.org http://www.personaltelco.net -- overthrowing QWest, one block at a time.
This archive was generated by hypermail 2b30 : Sun May 26 2002 - 11:40:58 PDT