Date: Mon, 03 Mar 2014 11:29:41 -0700 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: CVE Request?: konqueror - https uses all ciphers, even weak ones -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 03/03/2014 06:06 AM, Tim Brown wrote: > On Thursday 27 February 2014 17:30:54 Marcus Meissner wrote: >> Hi, >> >> I am wondering a bit ... >> >> We received this bugreport for the KDE default webbrowser >> Konqueror: https://bugzilla.novell.com/show_bug.cgi?id=865241 >> >> Basically https://www.howsmyssl.com reports that even the weak >> EXPORT ciphera are in use by konqueror. >> >> And yes, it is right... DES40, RC2, DES_CBC (single DES) ... >> should definitely not be used these days anymore. >> >> >> Do you think use of export ciphers should get CVEs these days? >> >> It does not seem intentional, konqueror just uses everything >> openssl has without explicit filtering by default. As the stated purpose of encryption is to strongly protect communications, both integrity (e.g. modification) and confidentiality (e.g. not being able to read it) then using encryption such as DES 40/56 can be broken in single digit seconds (I'm guessing near real time now with dedicated hard ware) and hours on standard PCs obviously violates the stated intent of using encryption. So the question becomes where do we draw the line? 40 and 56 are obviously weak, standard computers, let alone something with a GPU can crack it quickly. Do we draw the line at <128 bits, <3DES or something else? - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJTFMoUAAoJEBYNRVNeJnmTh3gP/1tNIrALc+jAp/x1GuvVphn6 WrB9LG6sKWD+4lvQDEDGtqJwxU8L7r4rh0BDasUQlh0M5+ykwObud3qD1+AWejLE gpxPhyqFuDw6EDxVRmkLV5IDT2KVSwSUuZgeT54bsuvVgnnFG+leA3TqAN15zOrT SBdmBOAIS5xf65BhuuL5vyU+DpUe9J2A9aF0eeBELhi2UALXdr3voU5kKukD3ZCo 2/aWHIJDQ/F2dxtLqzO5Y3VWhbbSyaTdO2ah/iBn8sfd7yEh+RHa4On3pf15716b Ekz1XilF5umZ7A2MUfGTsUIkxKqLl56a97XuwRgCqCOgvJ5nsNLk5GX+0owPr9wt YBWMO1JCY/TWJVMYfCEuFgRSyERcHozIJYtqMWDHNPgt9Qg8gpTSvRX1mNUUm0um p6Bz9k/RhZ2e7y50JlMgoAFVi2VxlvhwRUmUcNGIiziMQTAqbaaxaZJH9AahSm7A nqprQkbtx6A0zTv80M0PpXnGEhOU48GeoDIP5COyyFF8uA6ewuc17qM0B0isQLTz kVI71fDflhs/QObuk6+tvUDPAWBlHuj+pCxBJEO0PDh8rQ6yBug2nMfYk+zE4W3v sYXBclQGESg8ANWPIYBzratci3RJrh0IMw1CdT+TjL3LldBJ4q1ll2Ndf+hy1Fsg 88iw1FGkCTBFc+kRkzHJ =IRqF -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ