On Thu, May 29, 2008 at 09:48:38AM +0200, Steffen DETTMER wrote:
> On the other hand, someone else could assume that all potentially
> weak keys are regenerated and the concerned (boxes,
> systems, admins, security professionals, ...) now are more
> sensitive, carefully exchanged all keys against, installed IDSes
> scanning the network traffic for traces of weak keys and this
> time double-verified everything, including exhaustive use of all
> the black-hat attack tools to test themselfs, and from that
> conclude that it makes no sense to check that keys at all because
> noone will ever use them and if someone accidently created one,
> security test tools will alert `potential valgrind-SSL key' or
> alike.
>
> (I would start searching those `frequently existing' keys :-))
>
> Does this make sense or am I wrong? A complicate topic I think,
> and very interesting :)
And then knowing that attackers never choose these keys, users start
using these keys because attakers avoid them, and then attackers start
checking these first again, ... This way lies madness. Fix your premise
and don't change it in flight.
--
Viktor.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
