[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 03 Mar 2014 11:29:41 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request?: konqueror - https uses all ciphers,
even weak ones
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 03/03/2014 06:06 AM, Tim Brown wrote:
> On Thursday 27 February 2014 17:30:54 Marcus Meissner wrote:
>> Hi,
>>
>> I am wondering a bit ...
>>
>> We received this bugreport for the KDE default webbrowser
>> Konqueror: https://bugzilla.novell.com/show_bug.cgi?id=865241
>>
>> Basically https://www.howsmyssl.com reports that even the weak
>> EXPORT ciphera are in use by konqueror.
>>
>> And yes, it is right... DES40, RC2, DES_CBC (single DES) ...
>> should definitely not be used these days anymore.
>>
>>
>> Do you think use of export ciphers should get CVEs these days?
>>
>> It does not seem intentional, konqueror just uses everything
>> openssl has without explicit filtering by default.
As the stated purpose of encryption is to strongly protect
communications, both integrity (e.g. modification) and confidentiality
(e.g. not being able to read it) then using encryption such as DES
40/56 can be broken in single digit seconds (I'm guessing near real
time now with dedicated hard ware) and hours on standard PCs obviously
violates the stated intent of using encryption.
So the question becomes where do we draw the line? 40 and 56 are
obviously weak, standard computers, let alone something with a GPU can
crack it quickly. Do we draw the line at <128 bits, <3DES or something
else?
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBAgAGBQJTFMoUAAoJEBYNRVNeJnmTh3gP/1tNIrALc+jAp/x1GuvVphn6
WrB9LG6sKWD+4lvQDEDGtqJwxU8L7r4rh0BDasUQlh0M5+ykwObud3qD1+AWejLE
gpxPhyqFuDw6EDxVRmkLV5IDT2KVSwSUuZgeT54bsuvVgnnFG+leA3TqAN15zOrT
SBdmBOAIS5xf65BhuuL5vyU+DpUe9J2A9aF0eeBELhi2UALXdr3voU5kKukD3ZCo
2/aWHIJDQ/F2dxtLqzO5Y3VWhbbSyaTdO2ah/iBn8sfd7yEh+RHa4On3pf15716b
Ekz1XilF5umZ7A2MUfGTsUIkxKqLl56a97XuwRgCqCOgvJ5nsNLk5GX+0owPr9wt
YBWMO1JCY/TWJVMYfCEuFgRSyERcHozIJYtqMWDHNPgt9Qg8gpTSvRX1mNUUm0um
p6Bz9k/RhZ2e7y50JlMgoAFVi2VxlvhwRUmUcNGIiziMQTAqbaaxaZJH9AahSm7A
nqprQkbtx6A0zTv80M0PpXnGEhOU48GeoDIP5COyyFF8uA6ewuc17qM0B0isQLTz
kVI71fDflhs/QObuk6+tvUDPAWBlHuj+pCxBJEO0PDh8rQ6yBug2nMfYk+zE4W3v
sYXBclQGESg8ANWPIYBzratci3RJrh0IMw1CdT+TjL3LldBJ4q1ll2Ndf+hy1Fsg
88iw1FGkCTBFc+kRkzHJ
=IRqF
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
