Date: Wed, 13 Nov 2013 00:36:00 -0700 From: Kurt Seifried <kseifried@...hat.com> To: Open Source Security <oss-security@...ts.openwall.com> Subject: Microsoft Warns Customers Away From RC4 and SHA-1 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - From Slashdot: "The RC4 and SHA-1 algorithms have taken a lot of hits in recent years, with new attacks popping up on a regular basis. Many security experts and cryptographers have been recommending that vendors begin phasing the two out, and Microsoft on Tuesday said it is now recommending to developers that they deprecate RC4 and stop using the SHA-1 hash algorithm. RC4 is among the older stream cipher suites in use today, and there have been a number of practical attacks against it, including plaintext-recovery attacks. The improvements in computing power have made many of these attacks more feasible for attackers, and so Microsoft is telling developers to drop RC4 from their applications. The company also said that as of January 2016 it will no longer will validate any code signing or root certificate that uses SHA-1." http://threatpost.com/microsoft-warns-customers-away-from-sha-1-and-rc4/102902 http://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-2868725-recommendation-to-disable-rc4.aspx http://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-2880823-recommendation-to-discontinue-use-of-sha-1.aspx I'm inclined to agree. The question I suppose is, like DES (and 3DES/MD5) at what point do we start assigning CVE's for some of this? thoughts and comments welcome. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) iQIcBAEBAgAGBQJSgyvgAAoJEBYNRVNeJnmTrSIQAJs4xB656Th6dRpFKgIcipB8 HKeKt+fKYBV+a5njw3EXBVlDuQ8pbFhngMrPA0Ym5qSvgpTlRD0tSKIYB+nmnA2Q nNby58VGGPfRrSaMFwLPS6Kt8p/vSXdyES/CkwHrN2uzUZ1IihuKs8p37pTgiM/U QJK43tt1wRgSy/vIjiWatz1aeGtz/jXDpq3b+EInPsc9xmvnmchptmU6rZH/xtyu nBadOwWiYOTqEAE2EZvoH1QQD2u/JQiWMnJf3MzFAnLus2CtdJO6Ol/1Y6lvDpw3 9W5994Tf00D90Rduerev8vugPgfDTHZJS8vpzLVHS4V4Sm5Lah2mWyFYrKLaIOQY pzhofdLI2KWw9Ecjhj+z7FNsCr9goSbZILOKUrH0oVRoMtSH4a8V+MJLP1IQSpnN ceOBo2ukJW+kSm6D0ZMDXOV/rmWfC4HEZIuhi8vxFXvSEGUgQaZzdd1JZK20iwPz 3BjGMqgrmcC8qUsXVraJfrG4NAWPUuB1L/I4qGLuqYo8L8NrLN0F0VApHP95kHn8 Q/iEHx+0+s/17D0KcjDgsR17A601oJjw4ku4CnXU9+sdlhdhERAKY70CZEBIcjPn yPwtnq0w4l0lxcQb+qIi9C+fCx9xnBrhTLorLLkx2JUB5qk+QOKMi6tV0k6Hxr83 l+hmVlhruE4OctgTtNHp =fAYL -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.