[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140408092512.GB11169@sivokote.iziade.m$>
Date: Tue, 8 Apr 2014 12:25:12 +0300
From: Georgi Guninski <guninski@...inski.com>
To: oss-security@...ts.openwall.com
Subject: Should openssl accept weak DSA/DH keys with g = +/- 1 ?
Not on list.
I am a noob at crypto.
IIRC similar attack was used against Tor
several years ago.
In DSA it is possible to force g=1 or g \equiv -1 \mod p.
The first is unit and the second is of multiplicative
order 2.
This are clearly weak and insane choices,
but this might have implications to MITM
(might be wrong on this).
For DH could generate key with g=1, though
couldn't test it.
Tested both 1 and -1 cases in DSA,
the probability of successful connection
was about 1/4 (or maybe 1/2), errors in the
other cases. (for $1$ I would expect probability
$1$).
Attached are cacert.pem and cacert2.pem,
the magic word is 1234.
To test:
$ openssl s_server -accept 8888 -www -cert cacert.pem
$ openssl s_client -connect localhost:8888 -showcerts
To examine
$openssl x509 -text -in cacert2.pem
$openssl dhparam -text -in dHParam.pem
(not sure if dHParam.pem this is usable, forged generation).
Firefox refuses connections, Konqueror works
with same probability.
Suspect this might be related to EC refusing
the point at infinity.
Might have MITM implications, don't have
working exploit (If a MITM can forge $g=1$ in DH,
the private keys are useless).
View attachment "cacert.pem" of type "text/plain" (1968 bytes)
View attachment "cacert2.pem" of type "text/plain" (1563 bytes)
View attachment "dHParam.pem" of type "text/plain" (246 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
