Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 15 Nov 2013 13:32:04 -0700
From: Kurt Seifried <>
Subject: Re: cryptographic primitive choices [was: Re: Microsoft
 Warns Customers Away From RC4 and SHA-1]

Hash: SHA1

On 11/15/2013 12:18 PM, Chris Palmer wrote:
> On Thu, Nov 14, 2013 at 10:58 PM, Kurt Seifried
> <> wrote:
>> Think of all the things that currently use (often older versions
>> of) OpenSSL/PolarSSL/GnuTLS/etc and will never get updated...
> I posit that there is a strong correlation between un-updated, 
> un-updatable software that did not ship with (for example) support
> for modern cipher suites and protocols, and software that should
> be recalled for a variety of reasons. Random example:
>  Let's unpack your use of the passive voice: Who, exactly, is
> choosing not to update the OpenSSL they ship? Why do we forgive
> that?

We don't have a choice? We already paid our money and as far as I know
we have no recourse? We can buy "not that vendor" but all the vendors
do this, simple economics, you paid for it, why would I spend money
supporting it? Especially when that model is no longer being
manufactured. Especially when my customers appear to have no
expectation that I'll support it?

This is why I bought a "dumb" TV. And why I won't get a carrier
controlled Android phone ever (they have a less then perfect upgrade
track record). But most people are not crazy and paranoid like me.

> To an extent, even security engineers are acting as enablers,
> allowing obsolete software/protocols/cipher suites to live far
> longer than they should have.

We can't force stuff to die, and I bet those security engineers
usually lose to managers talking about margins and such.

> "LTS", "ESR", and not EOL'ing Windows XP 4+ years ago is a
> significant part of the problem.

I can't speak to that, even if we support OpenSSL/whatever long term
that's only the tip of the proverbial ice berg. The supply chain for
this stuff is _deep_.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Version: GnuPG v1.4.15 (GNU/Linux)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.