> David Schwartz wrote:
>
> > Every known key, provided there are not too many known keys, is weak.
>
> Once again, you have a very idiosyncratic lexicon of cryptographic
> terms. How about if we use these words the way cryptographers do?
>
> A weak key is one that causes a cipher to leak pri
David Schwartz wrote:
Every known key, provided there are not too many known keys, is weak.
Once again, you have a very idiosyncratic lexicon of cryptographic
terms. How about if we use these words the way cryptographers do?
A weak key is one that causes a cipher to leak private data in the
On Wed, May 28, 2008 at 04:31:20PM -0700, David Schwartz wrote:
> > Only against random attacks of course, if all attackers first check these
> > keys, then removing them strengthens the algorithm against (non-random)
> > brute-force attack. This said, the effort of explicitly avoiding these
> > i
> On Wed, May 28, 2008 at 03:38:47PM -0700, David Schwartz wrote:
> > In principle, specifically avoiding these keys weakens the
> > algorithm by reducing the keyspace.
> >
> Only against random attacks of course, if all attackers first check these
> keys, then removing them strengthens the algo
On Wed, May 28, 2008 at 03:38:47PM -0700, David Schwartz wrote:
> In principle, specifically avoiding these keys weakens the algorithm by
> reducing the keyspace.
>
Only against random attacks of course, if all attackers first check these
keys, then removing them strengthens the algorithm again
> David Schwartz wrote:
> > ... Suppose I include a randomish
> > string in my message "46e8bd8ceae57f8b7af66536e7859bad". Any
> > attacker might
> > see this message -- it's public. So he can certainly try that
> > string as your
> > password. So will you now run off and add it to a blacklist
* Deane Sloan wrote on Thu, May 29, 2008 at 04:47 +1200:
> stated, the overall risk of generating such a key on an unaffected
> system is (extremely?) small for the security that a 2048bit RSA private
> key is intended for?
The risk to generate one specific key of 2^16 (or how small was
the key sp
Hello,
We have a PHP based system on a FreeBSD box that is supposed to talk
to a C# .NET app (Windows XP). We have these messages going to .NET as
signed SMIME correspondence. However .NET seems unable to read these
and fails with an ASN.1 exception. So the decision has been made to
wrap
Hello,
We have a PHP based system on a FreeBSD box that is supposed to talk
to a C# .NET app (Windows XP). We have these messages going to .NET as
signed SMIME correspondence. However .NET seems unable to read these
and fails with an ASN.1 exception. So the decision has been made to
wrap
--On Wednesday, May 28, 2008 12:19:25 -0500 Paul Schmehl
<[EMAIL PROTECTED]> wrote:
--On Wednesday, May 28, 2008 18:09:06 +0200 "Dr. Stephen Henson"
<[EMAIL PROTECTED]> wrote:
OpenSSL has supported sha1+RSA from the very beginning. You wouldn't expect
that error if it didn't recognize the alg
Hello, I'm using non-blicking sockets with an event-reporting mechanism
(epoll() on linux, kqueue() on freeBSD and select() elsewhere). When I
try and send bigger amount of data (eg: a file) via a connection via
OpenSSL, I eventually get "Operation not permitted" error on SSL_Write().
It alway
--On Wednesday, May 28, 2008 18:09:06 +0200 "Dr. Stephen Henson"
<[EMAIL PROTECTED]> wrote:
OpenSSL has supported sha1+RSA from the very beginning. You wouldn't expect
that error if it didn't recognize the algorithm even for totally
unsupported algorithms OpenSSL will still parse the certifi
On Wed, May 28, 2008, Paul Schmehl wrote:
> We use Verisign certs for signing and encrypting our email. This year
> Verisign changed the algorithm used for their certs from md5RSA to sha1RSA.
> Now all my unix and mac clients can no longer import their certs because
> openssl apparently doesn
Thank you Victor for your succinct clarification and to David and
Michael for their responses.
To tie this off - is it fair to say that the impact of say 2048bit RSA
SSL(etc) using a private key in the affected range is a valid
consideration/concern, however in combination with the likelihood
stat
Hi everybody.
I have a SSL client and two SSL servers: auth server and, for example, file
server.
Client connects to the auth server, handshakes with it, then auth server
sends socket
descriptor and SSL session to the file server via IPC. File server reads
socket descriptor,
duplicates it, then i
We use Verisign certs for signing and encrypting our email. This year Verisign
changed the algorithm used for their certs from md5RSA to sha1RSA. Now all my
unix and mac clients can no longer import their certs because openssl
apparently doesn't understand that algorithm.
This is the result
On Wed, May 28, 2008 at 08:09:16AM -0700, Michael Sierchio wrote:
> David Schwartz wrote:
>
> > ... Suppose I include a randomish
> >string in my message "46e8bd8ceae57f8b7af66536e7859bad". Any attacker might
> >see this message -- it's public. So he can certainly try that string as
> >your
> >p
David Schwartz wrote:
> ... Suppose I include a randomish
string in my message "46e8bd8ceae57f8b7af66536e7859bad". Any attacker might
see this message -- it's public. So he can certainly try that string as your
password. So will you now run off and add it to a blacklist, since it's
clearly now a
> Finally - how real is this concern? What is the probability that say a
> 2048bit generated key could fall into the 32,767 keys in the metasploit
> SSH example on unaffected systems?
>
> Best Regards,
>
> Deane
If you think about it, it doesn't make sense. Suppose I include a randomish
string in
On Wed, May 28, 2008 at 07:55:35PM +1200, Deane Sloan wrote:
> Finally - how real is this concern? What is the probability that say a
> 2048bit generated key could fall into the 32,767 keys in the metasploit
> SSH example on unaffected systems?
This concern is unwarranted.
--
Viktor.
__
Hello everyone,
I would like to add an extension to a X509v3 certificate.
I wrote :
void Addmyextension(X509* cert, int nid, char* value, bool crit)
{
X509_EXTENSION* ex = X509_EXTENSION_new();
ex->object = OBJ_nid2obj(nid);
crit? ex->critical = 0xff : ex->critical = -1; // Question 1
ASN1
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
OpenSSL version 0.9.8h released
===
OpenSSL - The Open Source toolkit for SSL/TLS
http://www.openssl.org/
The OpenSSL project team is pleased to announce the release of
version 0.9.8h of our open source
Hi,
I'm trying to test some algorithm with openssl comman line and oprofile.
Then, to separate the time used for the real cryptographic operation from
the time used for I/O operation, I need to know which library is used to
read a file.
The library can see are used in the execution of a command are
Hi,
Regarding the recently reported Debian patch of OpenSSL issue, the
affected keys would seem to be well known and with the metasploit site
hosting pre-computed keys and a number of scripts around various sites
available to take advantage of the specific problem, it would seem like
just a matter
Hi,
I'm trying to write a 3-DES decoder in Javascript, but I'm dealing
with input generated by other libraries, encoded in ASN.1. I ran
openssl on one of the sample inputs, to decode the ASN.1 for me,
here's the output:
[h-118 test]$ openssl asn1parse -i -inform DER -in dec
0:d=0 hl=
25 matches
Mail list logo
